Dave ....

Done. Just done. When I get the features on/off box, it's totally blank. I tried to include a screen shot but the forum choked. Thanks for trying. I'll just replace WinEx with something else. I appreciate your help.

CRAPADDODLE! The "turn features on and off" box is blank ... totally F-ing blank. Whatever White Smoke did to my PC, there is not enough fire in hell to punish them. FREE my ass. (thanks for your continued help ...) :-P

yes - I answered there. Just tried again and got the same result, even after three restarts and turning everything off, cleaning and removing everything I could find. maybe it's time for a Mac

I still can't search in Windows Explorer - that was the only problem I was aware of coming into this. I'm sure all the clean-up and malware removal has done me good, but I still can't search my own hard drive. I'm flummoxed. Might this be a good time to reload Win7 and call it a week? ;-) Thanks for all your help.

Mr.C, here's the new combofix log - it did not ask to reboot. Dave .... ComboFix.txt

Here's the screenshot

I looked and that file is not there - attached is a screen shot of the driver folder ...

:-O You assume I know too much? Codebox, textfield, script ... and it's Monday. Here's the log ... SystemLook 30.07.11 by jpshortstuff Log created at 11:18 on 13/05/2013 by Dave Administrator - Elevation successful ========== Filefind ========== Searching for "ntfs.sys" C:\Windows\erdnt\cache64\ntfs.sys --a---- 1659760 bytes [17:17 13/05/2013] [18:19 31/08/2012] E453ACF4E7D44E5530B5D5F2B9CA8563 C:\Windows\System32\drivers\ntfs.sys --a---- 1659760 bytes [13:52 10/10/2012] [18:19 31/08/2012] E453ACF4E7D44E5530B5D5F2B9CA8563 C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7600.16385_none_02661b64369ca03a\ntfs.sys --a---- 1659984 bytes [23:20 13/07/2009] [01:48 14/07/2009] 356698A13C4630D5B31C37378D469196 C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7600.16778_none_0273f3c63691c4ea\ntfs.sys --a---- 1657216 bytes [15:42 27/04/2011] [06:23 11/03/2011] E78999B86CC2414EA2A94AFCDB53AF2F C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7600.17119_none_02b5b16c36606152\ntfs.sys --a---- 1656688 bytes [13:52 10/10/2012] [18:02 31/08/2012] 184C189D4FC416978550FC599BB4EDDA C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7600.20921_none_032ca00d4f8d24c5\ntfs.sys --a---- 1685888 bytes [15:42 27/04/2011] [06:25 11/03/2011] 867C1395F0100CBE9ACD73B1C2741149 C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7600.21316_none_033c4f3f4f80b23e\ntfs.sys --a---- 1680240 bytes [13:52 10/10/2012] [18:19 31/08/2012] FDC7C8346B6D8274631951F1469F95D7 C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7601.17514_none_04972f2c338b23d4\ntfs.sys --a---- 1659776 bytes [21:40 09/06/2011] [13:33 20/11/2010] 05D78AA5CB5F3F5C31160BDB955D0B7C C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7601.17577_none_0459508233b9177f\ntfs.sys --a---- 1659776 bytes [15:42 27/04/2011] [06:41 11/03/2011] A2F74975097F52A00745F9637451FDD8 C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7601.17945_none_0477c74a33a2859a\ntfs.sys --a---- 1659760 bytes [13:52 10/10/2012] [18:19 31/08/2012] E453ACF4E7D44E5530B5D5F2B9CA8563 C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7601.21680_none_04d11b5b4ce521d9\ntfs.sys --a---- 1659776 bytes [15:42 27/04/2011] [06:19 11/03/2011] F3CBA6518CAB1FA8B260DDD0CB0FD415 C:\Windows\winsxs\amd64_microsoft-windows-ntfs_31bf3856ad364e35_6.1.7601.22104_none_052b7b9d4ca0cf8b\ntfs.sys --a---- 1687408 bytes [13:52 10/10/2012] [17:57 31/08/2012] B2746D84DDF68D09B41B72DF745CCBA6 Searching for "wininit.exe" C:\Windows\erdnt\cache64\wininit.exe --a---- 129024 bytes [17:17 13/05/2013] [01:39 14/07/2009] 94355C28C1970635A31B3FE52EB7CEBA C:\Windows\System32\wininit.exe --a---- 129024 bytes [23:52 13/07/2009] [01:39 14/07/2009] 94355C28C1970635A31B3FE52EB7CEBA C:\Windows\SysWOW64\wininit.exe --a---- 96256 bytes [23:36 13/07/2009] [01:14 14/07/2009] 86219AB7A02D0BD280457116A44DB7CF C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe --a---- 129024 bytes [23:52 13/07/2009] [01:39 14/07/2009] 94355C28C1970635A31B3FE52EB7CEBA C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe --a---- 96256 bytes [23:36 13/07/2009] [01:14 14/07/2009] 86219AB7A02D0BD280457116A44DB7CF -= EOF =-

Hi Mr.C, When I run SystemLook I get the broken gong and an error that only says "Script Required". Argh ...

OK - I found the ComboFix download ... a little buried on the page. I am attaching the log. During the scan I got "Console Based Script Host stopped running" errors at least a dozen times. Thanks for sticking with me ... Dave .... ComboFix.txt

When I went to the link, the download no button took me to "ReimageRepair" not ComboFix. Is it the same thing?

OK -- something happened.I can now search my Desktop (not something I need to do often) but I can't search my Libraries. It doesn't even seem to try.

Got an error message - "Windows Explorer has stopped working ...". It tried to find a solution and just stopped. No message, no nothin'.

My first symptom was that I could not search with Windows Explorer - still can't. Google research sad that was registry damage so I don't think we fixed that. There was some video affects - colors off kilter and screen going dim - those seem to have stopped. I first noticed the search problems after uninstalling White Smoke freeware. There were also some strange hyper link and page loading problems that I thought might be a Firefox issue, but I haven't experienced that since the scan/clean. Looking good so far. Any ideas on restoring the search functions? Thanks, Dave

Here are the adware and mbar logs system-log.txt mbar-log-2013-05-13 (08-42-04).txt AdwCleanerS1.txt