Now rescan again with hijack, insert a check next to each of the following then close all other open browser windows and click "fix checked"
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.isearch.com/index.php?app=SE&af...ODQ6NTo5&Terms=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.seekerbar.com/ie.aspx?tb_id=50154
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.seekerbar.com/ie.aspx?tb_id=50154
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.isearch.com/index.php?app=SE&af...ODQ6NTo5&Terms=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\about.htm
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
O2 - BHO: ZServObj Class - {00000000-C1EC-0345-6EC2-4D0300000000} - C:\WINNT\ZServ.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - D:\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1001\en-xu\stmain.dll (file missing)
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - D:\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-nz\msntb.dll (file missing)
O3 - Toolbar: xtramsn - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-nz\msntb.dll (file missing)
O4 - HKLM\..\Run: [dbhfibyiqklx] C:\WINNT\system32\daxvhqa.exe
O4 - HKLM\..\Run: [satmat] C:\WINNT\satmat.exe
O4 - HKLM\..\Run: [farmmext] C:\WINNT\farmmext.exe
O4 - HKLM\..\Run: [duptziwm] C:\WINNT\System32\wprikl.exe
O4 - HKLM\..\Run: [Windows DLL Loader] C:\WINNT\system32\defragfatx.exe
O4 - HKLM\..\Run: [Win Microsoft Config] wnmsconfig.exe
O4 - HKLM\..\RunServices: [Win Microsoft Config] wnmsconfig.exe
O4 - HKCU\..\Run: [Win Microsoft Config] wnmsconfig.exe
O16 - DPF: {99802379-7362-40E2-9D28-8A3B9AF880B7} - http://hotsearchbar.com/toolbar2/winhot32.cab
then set the system to show hidden files and folders as per
http://www.spyware911.net/forum/index.php?...ge&pg=showfiles
reboot into safe mode
http://www.spyware911.net/forum/index.php?...age&pg=safemode
Then locate and delete:
C:\WINNT\system32\
daxvhqa.exe
C:\WINNT\
satmat.exe
C:\WINNT\
farmmext.exe
C:\WINNT\System32\
wprikl.exe
C:\WINNT\system32\
defragfatx.exe
Navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.
Go to Start > Run and type %temp% in the Run box. The Temp folder will open. Click Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.
Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.
Empty the Recycle Bin
Reboot
Get The latest version of Adaware
You can download the free version here:
http://www.lavasoftusa.com/support/download/
or here (alternate download location)
http://www.majorgeeks.com/download506.html
You need to be logged on as Adminstrator through the installation.
For ease in installation and operation, view the tutorial here
http://www.spyware911.net/forum/index.php?...page&pg=adaware
Just download it to your desktop and then to install click on the file you just downloaded (aawsepersonal.exe). You will be guided through the installation. It is recommended to use the default setting of "Protect anyone who uses this computer".
On the main screen of Adaware please look for the *check for updates now* link, just above the start button in the bottom right corner or you can click on the Webupdate button that looks like a globe icon at the top. Press * connect* to let it check for any recent updates. If any are found, please let it download and install them.
Now, configure your settings. Click the gear icon at the top. These are the recommended settings:
AAW SE settings
General Button
Safety:
Check (Green) all three.
Advanced Button
Logfile Detail Level:
All options under this should be checked (Green).
Tweak Button
Check (Green) the following:
Log Files
Include basic Ad-Aware settings in logfile:
Include additional Ad-Aware settings in logfile:
Please do not check (Green): Include Module list in logfile:
On your first scan, use the Full Scan (Perform full system scan) mode.
Let Adaware remove any *bad* objects found. Reboot your PC and scan again. Repeat this process until no more bad items are found. It may take several scans to clean everything, depending on the type of infections found.
Then post a fresh hijack log.