[Mobo]

Please make sure that you can view all hidden files. Instructions on how to do this can be found here:
http://www.spyware911.net/showhiddenfiles.htm


Please download about:Buster from here: http://www.spyware911.net/downloads/AboutBuster.zip
Once it is downloaded extract it to
c:\aboutbuster. Navigate to the c:\aboutbuster directory and double-click on aboutbuster.exe When the tool is open press the OK button, then the Start button, then the OK button, and then finally the Yes button. It will start scanning your computer for files. If it asks if you would like to do a second pass, allow it to do so.



Then close all programs and windows and run hijackthis. Put a checkmark next to each of these entries and press the fix button when ready:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\yegxe.dll/sp.html#12345

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\yegxe.dll/sp.html#12345

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\yegxe.dll/sp.html#12345

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\yegxe.dll/sp.html#12345

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\yegxe.dll/sp.html#12345

R0- HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\yegxe.dll/sp.html#12345

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {E1545A56-DE0C-2E0C-EE11-ABB18D6F1A8E} - C:\WINDOWS\ntmr32.dll

O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"


O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: (HKLM)

O16 - DPF: {6FDB0065-2787-11D6-B1D8-0001023916FC} (CLOActiveXInstaller Control) - http://www.igl.net/clo/install/CLOAc...allerProj1.cab

O23 - Service: ZESOFT - Unknown - C:\WINDOWS\zeta.exe (file missing)

Now open windows explorer, find then delete:
C:\WINDOWS\system32\yegxe.dll
C:\Program Files\webHancer


Copy the contents of the Quote Box below to Notepad.
Name the file as fix.reg
Change the Save as Type to All Files
Save this file on the desktop


<span style="color:#9999FF">REGEDIT4


[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\HSA]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\SE]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\SW]</span>


Then double-click on the fix.reg file, and when it prompts to merge say yes, and this will clear some registry entries left behind by the process.



[*]Download the Hoster from here. Press "Restore Original Hosts" and press "OK". Exit Program. This will restore the original deleted Hosts file.
[*]Open IE, go to Tools>Internet Options>then click on the security tab, then click on custon label. Check the following settings:

• Download Signed ActiveX controls-set to Prompt.
• Download Un-Signed ActiveX controls-set to Disable.
• Initialize and script ActiveX controls marked as unsafe-set to disable.

[/list]
Run an online antivirus scan at one of the links here:
http://www.spyware911.net/virusscanners.htm


Reboot and post a fresh log