ms removal tool

Does the MS Removal screen keep appearing, or is the issue now just that the Internet is not working correctly?

Malwarebytes, like mentioned above, is a good tool to keep in your anti-malware arsenal. Also, Combofix from the bleepingcomputer.com site could help in quelling this malware issue as well.

Another option is to reboot to "Safe Mode with Networking".
Then follow these recommended instructions to download up to four different free anti-malware software, from the list shown.
HitmanPro is particularly good.

Alternate MS Removal Tool removal instructions are also shown here, using HijackThis or Process Explorer (in Normal mode):
http://deletemalware.blogspot.com/2011/03/how-to-remove-ms-removal-tool-uninstall.html

Please note that in some cases the "rogue program" may block your attempts to remove it.   If this is the case, you may need to rename the installer to iexplore.exe or winlogon.exe, as described in that last link.

the problem is ms removal tool keeps appearing.
i go to safe mode with netowrking and still cant connect to the internet. malaware bytes cant be updated and the AV wont work without internet.

i uncheck the proxy server as suggested but nothing. without the internet i cant remove this.

have you had any joy removing it the way i suggested in the first post?

you may need to download malware bytes on another computer and copy it over via usb key.

You could download Rkill to another machine, then copy it across using usb.
Rkill is a small, freeware and portable tool designed to terminate active malware processes allowing you to use other removal tools:
http://www.technibble.com/rkill-repair-tool-of-the-week/

Another alternative ... Rogue-Killer ... recently recommended by younghv, who was introduced to it by rpggamergirl, an EE Virus/Spyware advisor.  He has produced an excellent article in this link.
For the record i have no experience using Rogue Killer, but i am impressed at what i've read:
https://www.experts-exchange.com/Virus_and_Spyware/Anti-Virus/A_4922-Rogue-Killer-What-a-great-name.html

"...i go to safe mode with netowrking and still cant connect to the internet..."

Have you reset your hosts file as suggested in the Bleeping Computer article you referenced?  Info is at item 22/23/24;

Are you sure that Rkill ran?  There are 7 seperate file names and extensions for Rkill - try each one until it runs.  A cmd prompt will open, some time will go by, and then a report will appear telling you which rogue process(es) got terminated.

Is Mbam fully updated?  Make sure it is, then run it again and please post the scan log here.

Mbam should be able to remove this infection in one pass...

ok with the 1st post i removed an entry with hijack this and reboot the pc and the internet now works

i will run AV stuff now

After you unchecked the proxy, you would then need to run the renamed Rkill to kill the process before MalwareBytes can run.

Did you download all the stuff needed before you went to safe mode with networking?
Because even if you  already unchecked the proxy, the nasties are still active until you run Rkill....after Rkill then that's when MalwareBytes have a chance to update.... if still no internet connection after unchecking the Proxy and running RKill, then run the Hosts-perme.bat and delete your Hosts file.

You can also try the rogueKiller as suggested.

Thats good.   Please ensure you update Malwarebytes and other AV software before running them.
IMHO you should not now need to run ComboFix as its really more suitable for a heavily infected computer.

Oops, missed the above post, didn't refresh the page.

Oops, seems i didn't refresh the page.

@ rpg  ... snap  :)

@ Jonvee, great minds think alike?... :)

Good idea suggesting CF, but where's your link? lol

-------------
ComboFix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please post the resulting log.

thanks a lot:)

@ jagguy ... glad you've resolved it.

@ rpggamergirl,
      >> Good idea suggesting CF, but where's your link? lol <<

Although its academic now, CF wasn't my suggestion, the initial advice was from yobri ... rightly or wrongly my suggestion was just some additional advice <grin>