Once you do a system restore it works and then messes up again?
You are probably still infected.
Do you have an earlier restore date?
If you do, try the oldest one available. We need to see if we can get back to before the system became infected.
If that doesn't work:
Run both Adaware and Spybot Search and Destroy from safe mode, updating each program before you scan and allowing both to fix what they find.
*AdAware SE: http://www.majorgeeks.com/download506.html
*Spybot S&D: http://www.safer-networking.org/en/index.html
Following that that I suggest you post a “HijackThis” log for expert assistance with your problem.
Read the pinned post in our “HijackThis” forum, herehttp://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/ Carefully read and follow all directions explicitly.
Following instructions run a log, and post it in following HJT forum, at this link
. Include a brief description of your computer (ie, processor, amount of RAM, brand or motherboard, etc, and the problem you are experiencing.)http://www.bleepingcomputer.com/forums/posthjtlog.htmlUnless you are expert at editing the registry, Do not as yet attempt to fix anything by yourself using Hijack This as even what may seem to be a small mistake can render your op system inoperable.
Some files when in one folder may be fine while in another may be malware.
A member of our HJT Team will analyze your log, make recommendations and offer assistance.
It may take a period of time to get a response to the log you posted because the members of our HJT Team are kept very busy. Please
be patient as this team is manned by volunteers. They will help you in order received as soon as possible.NOTE
Once you have posted your HJT log, please DO NOT make any additional posts in the HJT forum thread you created until you get a response from a member of our HJT expert team, and do not make any changes to your system (changes, including any attempted repairs, will make it different than displayed in the log you posted and therefore make your log inaccurate).
The first criteria they have when looking for logs that need replies are posts showing 0 replies
. If you make an additional post, it will show as having 1 reply
A team member, looking for a new log to work on might well assume another HJT Team member is already assisting you and might not open the thread to respond.
So, make your post and wait for a response from a team member.