I need help getting rid of winfixer 2005..on windows 98

1:48 PM: hp authorized customer@adlegend[1].txt (ID = 2074) 1:48 PM: hp authorized [removed][2].txt (ID = 2729) 1:48 PM: Found Spy Cookie: tracking cookie 1:48 PM: hp authorized customer@tracking[2].txt (ID = 3571) 1:48 PM: hp authorized [removed][2].txt (ID = 2038) 1:48 PM: hp authorized [removed][2].txt (ID = 3400) 1:48 PM: Found Spy Cookie: banners cookie 1:48 PM: hp authorized customer@banners[1].txt (ID = 2282) 1:48 PM: hp authorized customer@tracking[3].txt (ID = 3571) 1:48 PM: hp authorized [removed][1].txt (ID = 2038) 1:48 PM: hp authorized customer@uproar[2].txt (ID = 3612) 1:48 PM: hp authorized customer@rightmedia[4].txt (ID = 3259) 1:48 PM: hp authorized customer@uproar[4].txt (ID = 3612) 1:48 PM: hp authorized [removed][2].txt (ID = 5015) 1:48 PM: hp authorized customer@atwola[5].txt (ID = 2255) 1:48 PM: hp authorized customer@pricegrabber[3].txt (ID = 3185) 1:48 PM: hp authorized [removed][1].txt (ID = 2506) 1:48 PM: hp authorized [removed][2].txt (ID = 2335) 1:48 PM: hp authorized customer@go[3].txt (ID = 2728) 1:48 PM: hp authorized customer@atwola[2].txt (ID = 2255) 1:48 PM: hp authorized [removed][2].txt (ID = 2729) 1:48 PM: Found Spy Cookie: burstnet cookie 1:48 PM: hp authorized customer@burstnet[1].txt (ID = 2336) 1:48 PM: hp authorized customer@bizrate[2].txt (ID = 2308) 1:48 PM: Found Spy Cookie: xzoomy cookie 1:48 PM: hp authorized [removed][1].txt (ID = 3742) 1:48 PM: Found Spy Cookie: spywarelabs install cookie 1:48 PM: hp authorized [removed][1].txt (ID = 3421) 1:48 PM: hp authorized customer@a[3].txt (ID = 2027) 1:48 PM: Found Spy Cookie: offeroptimizer cookie 1:48 PM: hp authorized customer@offeroptimizer[1].txt (ID = 3087) 1:48 PM: hp authorized customer@rightmedia[2].txt (ID = 3259) 1:48 PM: hp authorized customer@abetterinternet[3].txt (ID = 2035) 1:48 PM: Found Spy Cookie: localnrd cookie 1:48 PM: hp authorized [removed][2].txt (ID = 2933) 1:48 PM: hp authorized customer@servlet[2].txt (ID = 3345) 1:48 PM: hp authorized customer@about[5].txt (ID = 2037) 1:48 PM: hp authorized customer@go2net[4].txt (ID = 2730) 1:48 PM: Found Spy Cookie: dcskqeg2voifwznnd6alhtnei_8f3u cookie 1:48 PM: hp authorized customer@dcskqeg2voifwznnd6alhtnei_8f3u[2].txt (ID = 2501) 1:48 PM: hp authorized [removed][3].txt (ID = 3400) 1:48 PM: hp authorized [removed][1].txt (ID = 3665) 1:48 PM: hp authorized [removed][1].txt (ID = 2038) 1:48 PM: hp authorized [removed][1].txt (ID = 2038) 1:48 PM: Found Spy Cookie: howstuffworks cookie 1:48 PM: hp authorized customer@howstuffworks[2].txt (ID = 2805) 1:48 PM: hp authorized [removed][1].txt (ID = 2038) 1:48 PM: hp authorized customer@angelfire[1].txt (ID = 2221) 1:48 PM: hp authorized [removed][1].txt (ID = 3588) 1:48 PM: hp authorized customer@rightmedia[5].txt (ID = 3259) 1:48 PM: Found Spy Cookie: tickle cookie 1:48 PM: hp authorized [removed][1].txt (ID = 3530) 1:48 PM: hp authorized customer@infospace[4].txt (ID = 2865) 1:48 PM: Found Spy Cookie: exitfuel cookie 1:48 PM: hp authorized customer@exitfuel[1].txt (ID = 2635) 1:48 PM: hp authorized customer@adknowledge[2].txt (ID = 2072) 1:48 PM: hp authorized [removed]-stat[3].txt (ID = 3649) 1:48 PM: hp authorized customer@did-it[1].txt (ID = 2523) 1:48 PM: hp authorized customer@nextag[2].txt (ID = 5014) 1:48 PM: hp authorized customer@tracking[4].txt (ID = 3571) 1:48 PM: hp authorized customer@kount[4].txt (ID = 2911) 1:48 PM: hp authorized customer@customer[2].txt (ID = 2481) 1:48 PM: hp authorized customer@bizrate[3].txt (ID = 2308) 1:48 PM: hp authorized [removed][3].txt (ID = 3588) 1:48 PM: hp authorized customer@trb[3].txt (ID = 3587) 1:48 PM: hp authorized [removed][1].txt (ID = 3588) 1:48 PM: hp authorized customer@ask[2].txt (ID = 2245) 1:48 PM: hp authorized [removed][2].txt (ID = 2038) 1:48 PM: Found Spy Cookie: partypoker cookie 1:48 PM: hp authorized customer@partypoker[2].txt (ID = 3111) 1:48 PM: hp authorized customer@burstnet[3].txt (ID = 2336) 1:48 PM: Found Spy Cookie: e.spyspotter cookie 1:48 PM: hp authorized [removed][2].txt (ID = 2553) 1:48 PM: hp authorized [removed][2].txt (ID = 2293) 1:48 PM: hp authorized customer@atwola[6].txt (ID = 2255) 1:48 PM: hp authorized [removed][2].txt (ID = 2528) 1:48 PM: hp authorized [removed][5].txt (ID = 2335) 1:48 PM: hp authorized [removed][1].txt (ID = 2038) 1:48 PM: hp authorized customer@bizrate[4].txt (ID = 2308) 1:48 PM: hp authorized customer@atwola[8].txt (ID = 2255) 1:48 PM: hp authorized customer@atwola[7].txt (ID = 2255) 1:48 PM: hp authorized customer@tracking[1].txt (ID = 3571) 1:48 PM: hp authorized customer@bizrate[5].txt (ID = 2308) 1:48 PM: hp authorized customer@go2net[1].txt (ID = 2730) 1:48 PM: Found Spy Cookie: seeq cookie 1:48 PM: hp authorized [removed][1].txt (ID = 3332) 1:48 PM: hp authorized [removed][4].txt (ID = 2506) 1:48 PM: Cookie Sweep Complete, Elapsed Time: 00:00:39 1:48 PM: Starting File Sweep 1:49 PM: Warning: Failed to open file "c:\windows\pfpjobpr.{pb". The process cannot access

the file because it is being used by another process 1:49 PM: Warning: Failed to open file "c:\windows\win386.swp". The process cannot access the file because it is being used by another process 1:53 PM: Found Adware: 180search assistant/zango 1:53 PM: c:\windows\temp\fleok (ID = -2147480558) 1:53 PM: Found Adware: broadcastpc 1:53 PM: c:\windows\temp\64.exe (ID = -2147481328) 1:53 PM: c:\windows\temp\autoupdate0 (ID = -2147481415) 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11a1-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11a2-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11a3-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11a4-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11a5-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11a6-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11a7-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11a8-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11a9-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11aa-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11ab-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11ac-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11ad-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11ae-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11af-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11b0-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11b1-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11b2-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11b3-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11b4-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11b5-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11b6-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11b7-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11b8-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11b9-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11ba-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11bb-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11bc-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11bd-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11be-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11bf-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11c0-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11c1-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11c2-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11c3-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 1:53 PM: Warning: Failed to open file "c:\windows\application data\webroot\spy sweeper\temp\sscsf21b11c4-569f-11da-9e86-0008a18891ae.tmp". The process cannot access the file because it is being used by another process 2:42 PM: Traces Found: 1968

Ok, found quite a few things there. You may want to print out these instructions for reference, since you will have to restart your computer during the fix.

Please download AproposFix from here:
http://swandog46.geekstogo.com/aproposfix.exe

Save it to your desktop but do NOT run it yet.

Then please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.


Once in Safe Mode, please double-click aproposfix.exe and unzip it to the desktop. Open the aproposfix folder on your desktop and run RunThis.bat. Follow the prompts.

When the tool is finished, please reboot back into normal mode, and post a new HijackThis log, along with the entire contents of the log.txt file in the aproposfix folder.

It says I have to have Windows XP or windows 2000 to run this.

Ok, let's try a different set of scans next then. Please run full scans with Ad-Aware SE and Spybot-S&D as follows:
(If you already have Ad-Aware SE 1.06 and Spybot 1.4 installed, you can skip the installation steps. If you don't, please uninstall your old versions and install the new ones from the links below.)

Full Ad-Aware Scan
Please download Ad-Aware SE from here:
http://www.majorgeeks.com/download506.html
Install Ad-Aware and run it. In the bottom-right hand corner, click "Check for updates now". Click "Connect" to download the newest reference file.

Now we will configure Ad-Aware to perform a full scan. In the Ad-Aware main window, click on the gear icon at the top of the screen to open the preferences window. In the "General" window, make sure the following options are selected:
1) Automatically save log-file
2) Automatically quarantine objects prior to removal
3) Safe Mode (always request confirmation)

Click the "Scanning" button on the left-hand side and make sure the following options are selected:
1) Scan within archives
2) Scan active processes
3) Scan registry
4) Deep scan registry
4) Scan my IE Favorites for banned URLs
5) Scan my Hosts file

Please also click on "Select drives & folders to scan" and select your hard drive(s). Then click the "Advanced" button on the left-hand side and make sure all the options under "Log-file Detail Level" are selected. Next, click the "Tweak" button on the left-hand side. Click on "Scanning Engine" and make sure the following options are selected:
1) Unload recognized processes & modules during scanning
2) Obtain command line of scanned processes
3) Scan registry for all users instead of current user only

Click on "Cleaning Engine" and make sure the following options are selected:
1) Always try to unload modules before deletion
2) During removal, unload Explorer and IE if necessary
3) Let Windows remove files in use at next reboot
4) Delete quarantined objects after restoring

Finally, click on "Safety Settings" and make sure the following options are selected:
1) Automatically select problematic objects in results lists
2) Write-protect system files after repair (Hosts file, etc)

Click on "Proceed" to save the preferences. Then please click the "Start" button on the bottom right side to begin a scan. Select "Use custom scanning options" and then click "Next". Ad-Aware will then scan for malware. When it is finished, make sure any objects listed in RED are selected and click "Next" to remove the objects. Then please restart your computer.


Spybot Full Scan
Next, please download Spybot-S&D from here:
http://www.majorgeeks.com/download.php?det=2471
Install Spybot-S&D and run it. Select "Search for updates" and then select all available updates. Click on the drop-down box in the top center to choose a download location nearest to you. Then click "Download updates". When all updates have downloaded, close Spybot-S&D, and then run it again. Click on "Check for problems". When the scan has finished, select any entries listed in red and click "Fix selected problems". Then please restart your computer again.

Let me know how the scans go and if anything cannot be removed.

Ok, were those programs able to remove everything they found?

Yes

Ok, let's keep going. Please download the trial version of Ewido Security Suite here. Install it, and update the definitions to the newest files. Run the scan and allow it fix what it finds. Please post the log from Ewido for me to review.

Sorry to be a pain but you have to have windows 2000 to run this program.

Oops! Sorry about that! Please download a free trial of Trojan Hunter here and run a scan to clean up anything it finds.

Please disable SpySweeper, as it may hinder the removal of some entries. You can re-enable it after you're clean.

To disable SpySweeper:

• Open it click >Options over to the left then >Program Options >Uncheck "load at windows startup".
• Over to the left click "shields" and uncheck all there.
• Uncheck "home page shield".
• Uncheck "automatically restore default without notification".

Please run HijackThis and click "Scan." Place checks next to the following entries:
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R3 - Default URLSearchHook is missing
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\VZBB.DLL (file missing)
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\PROGRA~1\COMMON~1\VERIZO~1\SFP\VZBB.DLL (file missing)
O4 - HKLM\..\Run: [2iNXA5] "C:\WINDOWS\TEMP\CXTPLS_LOADER.EXE" /PC=CP.IST2 /SHUN /UNAR="/CTUN"
O4 - HKLM\..\Run: [rs2g36i] CRYWPROP.EXE
O4 - HKLM\..\Run: [SpySpotter System Defender] C:\PROGRAM FILES\SPYSPOTTER3\Defender.exe -startup
O4 - HKCU\..\Run: [aBtmRWGmh] CABFAX08.EXE
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxdm824YYUS
O9 - Extra button: Guide - {A6E07A80-436A-11d3-83B6-00902747E82E} - c:\windows\system\shdocvw.dll
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyPoker.net\partypokernet.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyPoker.net\partypokernet.exe (file missing)
O16 - DPF: {FC67BB52-AAB6-4282-9D51-2DAFFE73AFD0} - http://download.spyspotter.com/spyspotter/…rcabinstall.cab

Close all browser and other windows except for HijackThis, and click "Fix Checked" to have HijackThis fix the entries you checked.

Next, please enable viewing of hidden files as follows:

• Go to My Computer, and click on the "Tools" menu
• Click "Folder options"
• Select the "View" tab
• Make sure "Show hidden files and folders" is selected
• Make sure "Hide extensions for known file types" is unchecked
• Make sure "Hide protected operating system files (recommended)" is unchecked

Delete the following files and folders (if present):
C:\WINDOWS\TEMP\CXTPLS_LOADER.EXE <–This file
C:\Program Files\CxtPls <–This folder and its contents
C:\Program Files\AutoUpdate <–This folder and its contents
CRYWPROP.EXE <–This file. I am not sure where it is located, so you will have to search for it.
C:\PROGRAM FILES\SPYSPOTTER3 <–This folder and its contents
CABFAX08.EXE <–This file. I am not sure where it is located, so you will have to search for it.

Reboot your computer and post a new HJT log.

Ok, that log looks clean. How are things running?