I never did find out what the name of the virus we had was, but since it had a very obvious virus file called gimmysmileys1.exe, we’ll call it the Gimmysmileys worm.
I thought I had disabled it after last time, but the reports came in from my parents that it was back in full strength, so I had to return.
In between visits I discovered a program called hijackthis. Despite it’s name (sounds more like a worm itself) there were good reviews, and apparently a few people had had success with it.
So I downloaded it, chucked it on my memory drive and ran it on my parents computer. I could only run it in safe mode (press the restart button on your box when loading windows), but it worked a treat.
It displayed a huge list of programs (not sure this is the right term) and there was some limited advice on what each of these was. The hardest thing about using this program is determining what should be there and what shouldn’t, but I took a very harsh stance on this.
I removed almost everything (left winzip and office preloaders) and in the process killed norton (I can to reinstall), but also killed the virus, well almost.
The mistake I made was that I only removed the programs in one of the three user accounts on the system, and when I rebooted into normal windows, the worm/virus reinfected the other account. So to simplify, I deleted the two other accounts, went back into safe mode, removed the rubbish again and rebooted.
The system appeared to be clean, so I firewalled, reinstalled norton and downloaded all the windows updates. So all I can do now is wait and hope that the scourge has actually gone.