There are many routes for reinfection after a reboot, so you have to make sure all those spots are clean or the malware will just get reinstalled. Make sure to turn off and delete system restore points and other cache. You can post your hjt log here if you're not familiar with html tags.

Use Avast again and this time do a Boot-Time Scan. Booting to Safe Mode does you no good. It's undoubtedly a virus/file associated with Windows, not DOS, and even booting into safe mode the virus is already enabling/attaching itself.

Open Avast in Windows. Using the drop down menu select "Schedule Boot-Time Scan". Click all the check boxes. Make sure its set to scan all drives and to scan within compressed files as well.

Whether its Avast or other antivirus software of your choice, you must scan from DOS. By the time you've reached Windows, even Safe Mode, its too late.

Infections are harder than ever to clean.

Can you take the hard drive out, and place it in an external enclosure and then connect it to another computer and run your antivirus/antimalware scans?

I agree, anything that runs from that drive is going to be suspect at best, because the system has already loaded (in who knows what condition) at that point. Unfortunately, it's almost impossible to give a straight answer on what it "clean". As a security person, I'll tell you that the only way to be sure is to completely nuke the drive and do a clean install from a known good source. That's the only way to be 100% that the system is clean.

In practice, unless you have critically sensitive data, you can try the suggestions above. Just make sure you are scanning the drive as a secondary and using multiple tools to verify. The problem is that all scanners go after the most common infections. If the author has tweeked it at all, for example moving the executable to another location, the scanners may miss it. You need a good mix of signature-based and heuristic scanners. If you clean it as best you can and still see strange behavior or unexplained outbound connections or services, it's time to wipe and reinstall.

To others, please let this be yet another warning to backup your data regularly and make an image of the system before it gets infected. It's 1000x easier to load up a recent image and continue on than it is to start from scratch.

I did solve the reinfection problem.

I figured a followup was in order since so many good replies came from FW members.

I'm 99% sure the reinfection came from my cache in the browser. I thought the malware would find
any infected files in the cache because it had found infected cache files before.

However on a lark while reading I found a program called ATF-Cleaner.exe - that's the entire program
just a small exe file. The program lets you select from many places on your computer that files
might be saved but not really needed and it lets you delete them.

I can't recall why I decided to use the program. Maybe I read a post where someone mentioned that it
helped fix a reinfection problem.

When I used it I had no more reinfection problems.

I'm extremely happy with the results of this problem. While it was super irritating I'm thankful no
data was lost. And I'm happy that I found good help here and online.

I use the program above after using my browser. And I do avoid using IE browser. I've found that
it is just not as safe as Opera. I have not used Firefox so I can't comment.

But since Opera has less than 4% of the browser market and IE has over 50% it makes sense to hack
IE since the hacker will find so many more people to hack into.

Another place which I use but did not seem to help me fix the problem is

Shields-UP site which checks every port in your computer to verify if you are or are not invisible to
people running port scanners. The site is well written and has been in operation for at least 7 years.

Go here to verify your ports are not open and that you're invisible to hackers.

https://www.grc.com/x/ne.dll?bh0bkyd2

it's an odd url So if it's unique to me then use the main url ending at .com

The ATF cleaner is found here

http://www.atribune.org/index.php?option=com_content&task=view&i...

I only just read a note on his site where he offers ATFCleaner.

He states it's for XP and 2000 only.

Then he also states that for Vista he has disabled a few functions due to him not
knowing how some functions in ATF can affect Vista.

I used it on Vista and have had no problems and it did fix my reinfection problem. I've been away
so it's been about 3 weeks that I've been using ATF Cleaner with Vista and as I say no problems.

I click 'Select ALL' when I run ATF Cleaner on Vista

I've not had any issues with cookies or my login parameters to any sites
when using Opera 8x or Opera 9x.

So here's what worked for me.

Safe mode - run MalwareBytes
reboot into:
Normal Boot - run MalwareBytes
Reboot
Run ATF Cleaner
Run Malwarebytes again

If everything is OK then reboot and enjoy.

Note: You could probably modify when you run ATF Cleaner. It could be run first I suppose without
any harm as it's only deleting cache and files used by the browser and Windows Temporary files.

http://www.fatwallet.com/forums/technology/959280/m14256391#m142...