Hey guys,

I'm trying to clean a customer's computer, but I'm running out of options and it still isn't clean...

I've found (for now):

cws.msconfig
cws.svchost
eXact.ISENEng
SearchMiracle with related kalv*.exe files
A hijacked HOSTS file
QDownl Trojan
Dialer-Q
Trojano-620
Trojano-369 (aka Virtumondo... I think)

- The box is XP Pro with SP2, all updates/patches installed.
- It's a programmer's computer, and she's got MySQL server and IIS running on it... I don't have it connected to a network, so the new infections can't come from there...

- I turned off System Restore, and cleaned all TEMP files.
- Did all the regular stuff: CWShredder (found the cws.msconfig and cws.svchost, and cleaned them... they keep coming back, though), AdAware, Spybot, HiJackThis (all in Save Mode or from BartPE),...
- I cleaned the HOSTS file, made it read-only and removed (un)appropriate permissions. It was hijacked by SearchMiracle...
- Turned on SpyBot's TeaTimer, installed Google Toolbar
- Scanned with BartPE loaded with Avast, and another one with Stinger. Avast found and removed the Trojano's, but they seem to keep coming back...
- ProcessExplorer and TCPView don't show anything abnormal

I'm running Avast from BartPE again (takes around 2 hours... *sigh*) right now...

The problem is that when I do all those things (CWShredder, AdAware, Spybot, HiJackThis, Avast, Tauscan, Stinger,....) it seems to be clean. Reboot the box, though, scan again, and there's a bunch of crap again...

I think that those CWS's are causing all of it, and CA's help page isn't exactly helping... the processes I'm supposed to see aren't running, the files I'm supposed to see aren't there,...

Anything else I can try? Anyone found an application that actually CLEANS a computer instead of just reporting that it cleaned it? I'm on a deadline