Run the “Magic 4”. If you follow this proceedure it will remove almost any virus, trojan, or malware program.
FIRST THINGS FIRST, DISABLE SYSTEM RESTORE. Don’t ask why, just do it.
Boot into safemode, double check that system restore is still disabled, open msconfig and disable ALL startups and ALL non-Microsoft services. Apply, close, don’t reboot.
Open a command prompt, go to c:\windows\prefetch and del *.*
Go into regedit, go to HKLM\Software\Microsoft\Windows\Current Version\Run and RunOnce and delete all that don’t look familiar.
Do the same for HKCU\Software\Microsoft\Windows\Current Version\Run and RunOnce
NOTE: Once you have removed the malware, you can turn programs back on in msconfig.
Run SDFix
http://www.bleepingcomputer.com/files/sdfix.php
When it gets back into normal mode run Combofix
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
If it doesn’t reboot, do it yourself and go into safemode.
It may be gone at this point, if it is don’t bother going any further.
When it gets back up run VirtumundoBeGone.
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
Reboot back into normal mode and run smitfraudfix.
http://www.bleepingcomputer.com/files/smitfraudfix.php
Run a follow up Spybot S+D scan just to make sure you don’t have anything else.