Continually getting new infections

-----------------------------------------------------------
Press Start, Programs, Accessories, Command prompt, copy/paste the following command into the box and press OK:
(I am a little unsure about how to get a command line in Vista. You probably know).

cmd /c dir C:\*.* /L /A /B /S|Find "lich" >> "%userprofile%\desktop\look.txt"

A file called look.txt should appear on your Desktop. Please post the contents of this file.

We will kill all the files that show up

Crunge,
Please try to run in Normal mode.
It may not remove all, but it should report the ones that fail.

EDIT: If the script won't run in safe mode due to an os check, it won't run in normal either. Sorry for the Homer moment.
lich.exe and lich.sys are downloaders and need to go. There may be others. It's clear some of the tools we have don't work in Vista.

Can you try a Kaspersky scan? If we can ID the downloader(s) properly we can kill them. Kaspersky will need permission from Comodo and Vista to run an ActiveX..
Normal Instructions are here:

Using Internet Explorer, Please Do an Online Scan with Kaspersky WebScanner.
Go here to run an online scanner from Kaspersky.

• Click on "Kaspersky Online Scanner"
• A new smaller window will pop up. Press on "Accept". After reading the contents.
• Now Kaspersky will update the anti-virus database. Let it run.
• Click on "Next">"Scan Settings", and make sure the database is set to "extended". And check both the scan options. Then click OK.
• Then click on "My Computer", and the scan will start.
• Once finished, save the log to your Desktop as filename KAV.txt

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the license, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license is accepted, reset to 100%.
If the file KAV.txt appears to be too large to post (more than a couple hundred lines), let me know and I will give you instructions that will convert it to a smaller file.

askey127

Askey127,

Sorry for the delay but I'm on the road and won't have access to that machine again until this weekend. I'll follow your suggestions and post updates then.

This topic is now closed due to inactivity. If you wish it to be reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

If it has been 10 days or more since your last post, and the helper assisting you posted a response to which you did not reply, this topic will not be reopened. If you still require help, please start a new topic and include a fresh HijackThis log and a link to this thread in your new topic.

You can help support this site from this link :
Donations For Malware Removal

Please do not contact us to reopen this topic if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.

Re-opened at the request of the poster.

edit: replied to second open thread. This one archived again.-askey