Found this in Hj this

[mattiolio]

ikayyc.exe tries to access dl.web-nexus.net
hzip.exe tries to acess the same site so I think i'm getting close

[dalek]

Hi

You will probably need to flush your system restore points.

Go back to safe mode and disable system restore......How to disable system restore

Go to tools\folder options\view\show hidden files and folders
Also uncheck the box for Hide protected operating system files.

If you don't have this..Crap Cleaner get it and run it in safe mode as well and let it clean out all of your temp files.

After you have disabled System Restore and done your scans and cleaned out your temp files, reboot into normal mode (booting into normal mode will flush the system restore points contained in the folder systemvolumeinformation) and do another HJT log, if it's clean and you are not having problems re-enable your system restore.

[mattiolio]

Started in safe mode and disabled system restore, the results of the spybot scan were promising it found

Executable
c:\WINDOWS\system32\scvkkdv.exe

Program File
c:WINDOWS\system32\ikayyc.exe

Autorun settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winsync

so i removed them, ran adaware,
no problems there

ran ccleaner and let it clean every thing it wanted to
then rebooted in normal mode.

Then ran Hjt, the bastard is still there, so i repeated the process maybe i missed something but the results were the same!

I have been to the web-nexus site and tried to download their uninstaller but it says that my current settings wont allow me to download it ,wtf.

Any other ideas?

once again thanx for your time every one

Matt

[mattiolio]

well i got rid of it