Are you running XP?
If not, skip the next paragraph.
If so, close any web browsers. Now goto
c:\windows\prefetch and shred any files there that
contain the string Favorite Man, or something like
Favorite_Man. You can download a FREE file shredder from
download.com. You might have to do this in Safe Mode (F8
before Windows screen in boot/reboot) though, as the
files might be in use.
You can try booting into Safe Mode and running a full
system scan. The reason for booting into Safe Mode is
that only critical system processes are running.
Anytime you boot into Safe Mode to run these scans, make
certain to select the options that only states Safe
Mode. DO NOT choose Safe Mode with network support, NOR
Safe Mode with command prompt!
If cose has been inserted into the prefetch folder, then
anytime you launch the program that it's been linked to,
likely IE, then the spyware will reappear on your
system. If this is the case, then MSAS WAS correct that
it had removed the infection. Everytime you launched the
program that it was linked to in the prefetch folder, you
got reinfected.
DO NOT remove anything else from the prefetch folder.
The purpose of this folder is to speed up the load time
of applications. The only problem is that the writers of
these nasty applications have become wise to the fact
that they can insert code there to reinfect the system
once the infection has been removed.
Alan
