By the way I tried going at it three times without any luck.

When I used the following modifications below, it worked like a charm.

1. Since Combofix scans again after the reboot, it will take just as much time as before the reboot. If it “appears” to be freezing, don’t touch anything. Put your ear up to your computer and look at the HD activity light blinking. It is still running. It is only done when you see the log file on your screen.

2. The CFScript, because most of us create it on notepad, will have a .txt extension. That is fine.

3. I tried writing my CFScript to your instructions (ie. KILLALL:, registry entries) and for me it didn’t work. A little searching around the internet turned up these alternate rules:

INCLUDE FULL PATH OF THE FILES TO KILL. Therefore, suspicious.dll would become
************
File:
c:\windows\system32\suspicious.dll
c:\windows\system32\suspicious32.dll

************
Omit KILLALL on the heading of the CFScript

And registry entries to be killed only need the portion within the square brackets listed. Unless there are multiple entries under a square braketed key, I found I didn’t need the descriptive line. Cutting and pasting from HiJackThis log or ComboFix log is recommended.

Additional notes: Some sites recommend that you change the ComboFix.exe icon into a numerical icon. (ie. “123.exe”) because some malwares are smart enough to disable any programs called combofix.exe. However, ComboFix instructors seem vociferous about not changing the name.

Cheers!