I found the link to this on the old Hijack This webpage (I forget how to spell "Merjyn" etc." and have been playing around with it. I will say, that if Hijack This can do damage if used improperly, RUNSCANNER can do even more. You can also scan and post a log, etc. Maybe our Malware specialists on the forum are already aware of this utility, but I thought that I would mention it anyway. Have a look:

RUNSCANNER

[PS-to those not experienced in using an editor like this, be EXTREMELY careful-this one is a loaded shotgun, and you can do major damage to your operating system with one click of the mouse.]

Runscanner has just been updated; I ran the new one on my computer and it found a bunch of orphan register entrys. All orphan entrys are listed in red for easy targeting. The splash screen has been remodeled and is better. Now when you remove entrys, it has a removal button to click after those have been chosen, and they are all listed together in one page for review before deleting; makes mistakes far less of a possibility.

I like it!! Found and removed a lot of junk on my system.

Yes, I am still investigating everything, it is a deep program. It has a number of really interesting features, such as a shortcut launch to an online info sheet for the entry you are investigating. Also note the services, all those cryptic "svchost" entrys in Task Manager - now you can see which entry is controlling what function! Nice! Hijack This still reports some parts that Runscanner doesn't cover (yet) but right now it seems to be the front runner for replacment!

Another tool in the arsenal :-)

Where am I going wrong? I have downloaded again, and when trying to run, this is all I can get:

Click to view attachment

I kept having problems with this download. I tried a number of different things and noticed the size never equaled what it should have. Read up on their forum (www.runscanner.net) and saw someone else having the same problem. We were both using IE6.

So, I opened Firefox, it downloaded correctly, and then ran OK. So, if anyone else has problems try another browser.

kenneth

Thanks for the link Ranchhand.

Got infected somehow Thursday and none of the removal tools worked. They removed corrupted files, but not the one that was hidden and reinfecting the system. HijackThis did not see it either. I knew it was there because my AV saw it and kept disconnected internet access with the warning. It could not delete it, however.

Runscanner saw it, allowed me to kill the process and delete it. I wish I had tried it sooner. I was going back and forth half thinking about how to remove it and half thinking about ways malware writers should be done away with. Then I remembered this post.

Ken - - download problems in IE can result from the TIFs being too full, and the size of the TIF folder not being set large enough (in Internet Options, Temporary Internet Files, Settings). This folder has to be large enough to store a complete download before it transfers to the designated download folder, or it will be corrupt.

Thanks Jim. I deleted all temps prior to downloading. They also suggest that on their forum. But, I "cleaned", ran my maintenance programs, etc., and never got it to download????????????? And, the download is fairly small.

The person running the forum tried to duplicate my problem using IE 6 and 7, but could not. Just another one of those things I don't understand. (I have noticed there are more and more of those. )

Hey Efabes... wierd, I was infected with a Vundo variant (same day my daughter gets home from a trip and heads for the computer) over this week-end also and it took everything I could throw at it to kill it. Finally had to go in with UBD live distro to kill the files. Must be a new variant, there were 4 register entrys and five (5 - count 'em folks!) system32 entrys. SheeeezeLouissse!

Great progam! Thanks!