www pops up when in IM

I’ve tried it, I get those SAME links.

I’ve checked all the links in these forums. None seem to work.

They changed the way the infection worked.

I have recently updated the instructions to include a whole new amount of file names.

There is an order to do the things in, and that’s my order.

If a program is in memory, you may well delete it from the startup, you may even delete it’s file on disk, but at shutdown it will re materialise, because they are clever. So things must be taken out of memory, then deleted and removed. You only have to leave one part of it in memory, and it re creates its self. There may be more filenames, but I really can’t be sure of these, there is no info on the net regarding the infection, and nothing has detected it so far.

I recommend looking in msconfig (start, run, type msconfig) then click startup. Look at the commands, if you are not sure of some of them, paste them here and I can take a look. The ones I added recently where 8879.exe msroot msrootup and msrootocx. These are the ones installed by those urls mentioned by goforit, other URLs exist also.

Get an ADware, like lavasoft or spybot and do a scan. I was facing the same problem one day and all I did ws a complete scan by Norton AV, McAfee, and Lavasoft Adware. I never faced this problem again. This link might help http://helpbytes.co.uk/removal.php .HTH.