PC Hijacked - Please Help

I keep getting pop-ups from "The Best Offers" or "CERES". Ran Ewido with latest updates and it found and cleaned a lot out however, I'm still getting pop-ups from "The Best Offers" or "CERES". Below are my HijackThis and Ewido Logs. Please help.

Logfile of HijackThis v1.99.1
Scan saved at 10:24:43 AM, on 5/6/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mmc.exe
C:\WINNT\Explorer.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\internat.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINNT\system32\ndlzkx.exe
C:\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://government.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://government.dellnet.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SafeGuard Protect PCShield - {564FFB73-9EEF-4969-92FA-5FC4A92E2C2A} - C:\WINNT\system32\sfg_649b.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [BuildBU] c:\dell\bldbubg.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCShield] regsvr32 /s "C:\WINNT\system32\sfg_649b.dll"
O4 - HKLM\..\Run: [EbatesMoeMoneyMaker0] "C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe"
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - HKCU\..\Run: [PCShield] regsvr32 /s "C:\WINNT\system32\sfg_649b.dll"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200312…meInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1122746696890
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = andrewslibrary.mil
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = andrewslibrary.mil
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = andrewslibrary.mil
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe



———————————————————
ewido anti-malware - Scan report
———————————————————

+ Created on: 9:53:39 AM, 5/6/2006
+ Report-Checksum: EF8D6246

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{00F1D395-4744-40f0-A611-980F61AE2C59} -> Adware.DrSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{3D782BB3-F2A5-11D3-BF4C-000000000000} -> Adware.ActivShopper : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{7FD44536-9DF0-4034-939F-5BD4D98E3187} -> Adware.Generic : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{F5DE8ADB-4A69-4e56-96AB-823171C8E9D8} -> Adware.Generic : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Adware.WebRebates : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{7FD44536-9DF0-4034-939F-5BD4D98E3187} -> Adware.Generic : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00F1D395-4744-40f0-A611-980F61AE2C59} -> Adware.DrSearch : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F5DE8ADB-4A69-4e56-96AB-823171C8E9D8} -> Adware.Generic : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\bsto-1 -> Adware.BetterInternet : Cleaned with backup
HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\ZepMon -> Adware.BetterInternet : Cleaned with backup
HKLM\SYSTEM\CurrentControlSet\Services\SvcProc -> Adware.BetterInternet : Cleaned with backup
HKLM\SYSTEM\CurrentControlSet\Services\SvcProc\Security -> Adware.BetterInternet : Cleaned with backup
HKLM\SYSTEM\CurrentControlSet\Services\SvcProc\Enum -> Adware.BetterInternet : Cleaned with backup
HKU\S-1-5-21-1098517733-429030847-1718031890-500\Software\aurora -> Adware.BetterInternet : Cleaned with backup
HKU\S-1-5-21-1098517733-429030847-1718031890-500\Software\ceres -> Adware.BetterInternet : Cleaned with backup
HKU\S-1-5-21-1098517733-429030847-1718031890-500\Software\intexp -> Adware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-1098517733-429030847-1718031890-500\Software\intexp\Config -> Adware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-1098517733-429030847-1718031890-500\Software\intexp\MyFileSystem2 -> Adware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-602162358-1958367476-682003330-500\Software\BTGrab -> Adware.BetterInternet : Cleaned with backup
HKU\S-1-5-21-602162358-1958367476-682003330-500\Software\intexp -> Adware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-602162358-1958367476-682003330-500\Software\intexp\Config -> Adware.IEPlugin : Cleaned with backup
HKU\S-1-5-21-602162358-1958367476-682003330-500\Software\intexp\MyFileSystem2 -> Adware.IEPlugin : Cleaned with backup
[464] C:\WINNT\system32\DrPMon.dll -> Trojan.Agent.db : Error during cleaning
[1236] C:\WINNT\system32\ndlzkx.exe -> Trojan.Agent.ay : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\administrator@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\administrator@abetterinternet[1].txt -> TrackingCookie.Abetterinternet : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Addynamix : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\administrator@bestoffersnetworks[1].txt -> TrackingCookie.Bestoffersnetworks : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\administrator@cliks[2].txt -> TrackingCookie.Cliks : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\administrator@cnn.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\administrator@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\[removed]-targeting[2].txt -> TrackingCookie.Mx-targeting : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\administrator@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\administrator@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Liveperson : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\administrator@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Adserver : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@abcsearch[1].txt -> TrackingCookie.Abcsearch : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@abetterinternet[1].txt -> TrackingCookie.Abetterinternet : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\[removed][1].txt -> TrackingCookie.Adition : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\[removed][2].txt -> TrackingCookie.Addynamix : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\[removed][2].txt -> TrackingCookie.Pointroll : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\[removed][1].txt -> TrackingCookie.Specificpop : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@ads.x10[2].txt -> TrackingCookie.X10 : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@advertising[2].txt -> TrackingCookie.Advertising : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\[removed][2].txt -> TrackingCookie.Falkag : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@bfast[1].txt -> TrackingCookie.Bfast : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\[removed]-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\[removed][1].txt -> TrackingCookie.Enhance : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\[removed][2].txt -> TrackingCookie.Porngraph : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@centrport[1].txt -> TrackingCookie.Centrport : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@clickagents[1].txt -> TrackingCookie.Clickagents : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@cliks[1].txt -> TrackingCookie.Cliks : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@commission-junction[1].txt -> TrackingCookie.Commission-junction : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@com[1].txt -> TrackingCookie.Com : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\[removed][1].txt -> TrackingCookie.Coremetrics : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@findwhat[1].txt -> TrackingCookie.Findwhat : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@hotlog[2].txt -> TrackingCookie.Hotlog : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@linksynergy[2].txt -> TrackingCookie.Linksynergy : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@overture[1].txt -> TrackingCookie.Overture : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@qksrv[1].txt -> TrackingCookie.Qksrv : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\[removed][1].txt -> TrackingCookie.Advertising : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\[removed][1].txt -> TrackingCookie.Liveperson : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@serving-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@specificpop[2].txt -> TrackingCookie.Specificpop : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\[removed][2].txt -> TrackingCookie.Onestat : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@valueclick[1].txt -> TrackingCookie.Valueclick : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@valueclick[2].txt -> TrackingCookie.Valueclick : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\[removed][1].txt -> TrackingCookie.Epilot : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\[removed][1].txt -> TrackingCookie.Adserver : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Cookies\administrator@zedo[2].txt -> TrackingCookie.Zedo : Cleaned with backup
C:\Documents and Settings\administrator.ANDREWSLIBRARY\Local Settings\Temp\DrTemp\wupdsnff.exe -> Adware.BetterInternet : Cleaned with backup
C:\Documents and Settings\staff\Cookies\staff@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\staff\Cookies\[removed][2].txt -> TrackingCookie.Pointroll : Cleaned with backup
C:\Documents and Settings\staff\Cookies\staff@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup
C:\Documents and Settings\staff\Cookies\staff@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned with backup
C:\Documents and Settings\staff\Cookies\staff@clickagents[2].txt -> TrackingCookie.Clickagents : Cleaned with backup
C:\Documents and Settings\staff\Cookies\[removed][1].txt -> TrackingCookie.Coremetrics : Cleaned with backup
C:\Documents and Settings\staff\Cookies\staff@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\staff\Cookies\staff@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned with backup
C:\Documents and Settings\staff\Cookies\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\Documents and Settings\staff\Cookies\staff@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned with backup
C:\Documents and Settings\staff\Cookies\staff@hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned with backup
C:\Documents and Settings\staff\Cookies\staff@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup
C:\Documents and Settings\staff\Cookies\staff@qksrv[1].txt -> TrackingCookie.Qksrv : Cleaned with backup
C:\Documents and Settings\staff\Cookies\staff@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\staff\Cookies\staff@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\staff\Cookies\staff@valueclick[1].txt -> TrackingCookie.Valueclick : Cleaned with backup
C:\Documents and Settings\staff\Cookies\[removed][1].txt -> TrackingCookie.Adserver : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@abetterinternet[2].txt -> TrackingCookie.Abetterinternet : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@abetterinternet[3].txt -> TrackingCookie.Abetterinternet : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][2].txt -> TrackingCookie.Euroclick : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][1].txt -> TrackingCookie.Specificclick : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@adrevolver[1].txt -> TrackingCookie.Adrevolver : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][2].txt -> TrackingCookie.Addynamix : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][1].txt -> TrackingCookie.Pointroll : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][1].txt -> TrackingCookie.Aavalue : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@americasnotenetwork.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][2].txt -> TrackingCookie.Falkag : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@bestoffersnetworks[1].txt -> TrackingCookie.Bestoffersnetworks : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@bookspan.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][2].txt -> TrackingCookie.Bridgetrack : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][2].txt -> TrackingCookie.Bridgetrack : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@cliks[2].txt -> TrackingCookie.Cliks : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@cnn.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][2].txt -> TrackingCookie.Overture : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][2].txt -> TrackingCookie.Overture : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@epilot[1].txt -> TrackingCookie.Epilot : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@findwhat[1].txt -> TrackingCookie.Findwhat : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][2].txt -> TrackingCookie.Starware : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@infrastrategy.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@login.tracking101[2].txt -> TrackingCookie.Tracking101 : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][2].txt -> TrackingCookie.Adrevolver : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@overture[1].txt -> TrackingCookie.Overture : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@qksrv[2].txt -> TrackingCookie.Qksrv : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][1].txt -> TrackingCookie.Adjuggler : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][2].txt -> TrackingCookie.Falkag : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][1].txt -> TrackingCookie.Liveperson : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@statcounter[2].txt -> TrackingCookie.Statcounter : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@valueclick[2].txt -> TrackingCookie.Valueclick : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@webstat[2].txt -> TrackingCookie.Web-stat : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][1].txt -> TrackingCookie.Burstbeacon : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][2].txt -> TrackingCookie.Directnetadvertising : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][2].txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][1].txt -> TrackingCookie.Starware : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\[removed][1].txt -> TrackingCookie.Adserver : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@zedo[1].txt -> TrackingCookie.Zedo : Cleaned with backup
C:\Documents and Settings\staff1\Local Settings\Temp\Cookies\staff1@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\staff1\Local Settings\Temp\Cookies\[removed][2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\staff1\Local Settings\Temp\Cookies\[removed][2].txt -> TrackingCookie.Specificclick : Cleaned with backup
C:\Documents and Settings\staff1\Local Settings\Temp\Cookies\[removed][2].txt -> TrackingCookie.Realcastmedia : Cleaned with backup
C:\Documents and Settings\staff1\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Falkag : Cleaned with backup
C:\Documents and Settings\staff1\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Falkag : Cleaned with backup
C:\Documents and Settings\staff1\Local Settings\Temp\Cookies\staff1@bestoffersnetworks[1].txt -> TrackingCookie.Bestoffersnetworks : Cleaned with backup
C:\Documents and Settings\staff1\Local Settings\Temp\Cookies\staff1@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned with backup
C:\Documents and Settings\staff1\Local Settings\Temp\Cookies\staff1@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned with backup
C:\Documents and Settings\staff1\Local Settings\Temp\Cookies\staff1@centrport[2].txt -> TrackingCookie.Centrport : Cleaned with backup
C:\Documents and Settings\staff1\Local Settings\Temp\Cookies\staff1@cliks[1].txt -> TrackingCookie.Cliks : Cleaned with backup
C:\Documents and Settings\staff1\Local Settings\Temp\Cookies\[removed]-targeting[2].txt -> TrackingCookie.Mx-targeting : Cleaned with backup
C:\Documents and Settings\staff1\Local Settings\Temp\Cookies\staff1@pro-market[1].txt -> TrackingCookie.Pro-market : Cleaned with backup
C:\Documents and Settings\staff1\Local Settings\Temp\Cookies\staff1@qksrv[2].txt -> TrackingCookie.Qksrv : Cleaned with backup
C:\Documents and Settings\staff1\Local Settings\Temp\Cookies\staff1@questionmarket[1].txt -> TrackingCookie.Questionmarket : Cleaned with backup
C:\Documents and Settings\staff1\Local Settings\Temp\Cookies\staff1@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup
C:\Documents and Settings\staff1\Local Settings\Temp\Cookies\staff1@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned with backup
C:\Documents and Settings\staff1\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Burstbeacon : Cleaned with backup
C:\Documents and Settings\staff1\Local Settings\Temp\Cookies\[removed][1].txt -> TrackingCookie.Adserver : Cleaned with backup
C:\Program Files\TBONAS\TBONlchr.dll -> Adware.ActivShopper : Cleaned with backup
C:\RECYCLER\S-1-5-21-602162358-1958367476-682003330-1108\Dc22\fon34168[1].exe -> Trojan.Revop.c : Cleaned with backup
C:\RECYCLER\S-1-5-21-602162358-1958367476-682003330-1108\Dc23\Free_Warez[1].exe -> Adware.Lop : Cleaned with backup
C:\WINNT\dinst.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINNT\dsr.dll -> Adware.BetterInternet : Cleaned with backup
C:\WINNT\dsr.exe -> Trojan.Imiserv.c : Cleaned with backup
C:\WINNT\Nail.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINNT\OLD73.tmp -> Adware.BetterInternet : Cleaned with backup
C:\WINNT\polmx.exe -> Downloader.Agent.ae : Cleaned with backup
C:\WINNT\SET70.tmp -> Adware.BetterInternet : Cleaned with backup
C:\WINNT\svcproc.exe -> Adware.BetterInternet : Cleaned with backup
C:\WINNT\SYSTEM32\kwxjiic.exe -> Trojan.Poler.a : Cleaned with backup
C:\WINNT\SYSTEM32\ndlzkx.exe -> Trojan.Poler.a : Cleaned with backup
C:\WINNT\SYSTEM32\sfg_2173.dll -> Adware.SafeGuard : Cleaned with backup
C:\WINNT\SYSTEM32\xsvcfcm.exe -> Trojan.Poler.a : Cleaned with backup
C:\WINNT\SYSTEM32\__delete_on_reboot__mbihcq.exe -> Trojan.Poler.a : Cleaned with backup
C:\WINNT\wupdt.exe -> Downloader.OneClickNetSearch.g : Cleaned with backup


::Report End

Sorry for the delay in adding my post. I did as you instructed and here is my new Ewido and HijackThis logs. Thanks for all your help on this. I really appreciate it.

Logfile of HijackThis v1.99.1
Scan saved at 8:57:39 PM, on 5/11/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\Explorer.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\internat.exe
C:\Program Files\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio; - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [BuildBU] c:\dell\bldbubg.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1122746696890
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = andrewslibrary.mil
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = andrewslibrary.mil
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = andrewslibrary.mil
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe

———————————————————
ewido anti-malware - Scan report
———————————————————

+ Created on: 7:42:35 PM, 5/11/2006
+ Report-Checksum: 89536557

+ Scan result:

C:\Documents and Settings\Administrator\Cookies\administrator@bestoffersnetworks[2].txt -> TrackingCookie.Bestoffersnetworks : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\administrator@com[1].txt -> TrackingCookie.Com : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\administrator@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> TrackingCookie.Overture : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> TrackingCookie.Bestoffersnetworks : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\administrator@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\Administrator\Cookies\administrator@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@2o7[2].txt -> TrackingCookie.2o7 : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@edge.ru4[2].txt -> TrackingCookie.Ru4 : Cleaned with backup
C:\Documents and Settings\staff1\Cookies\staff1@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned with backup
C:\Program Files\TBONAS\TBONcomp.dll -> Adware.ActivShopper : Cleaned with backup
C:\WINNT\rrjyrxinc.exe -> Adware.BetterInternet : Cleaned with backup


::Report End

Ok…sorry about that. Here is the new HijackThis log. Thanks for the help.

Logfile of HijackThis v1.99.1
Scan saved at 5:34:10 PM, on 5/12/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\dell\bldbubg.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\internat.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://government.dellnet.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://government.dellnet.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [BuildBU] c:\dell\bldbubg.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1122746696890
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = andrewslibrary.mil
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = andrewslibrary.mil
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = andrewslibrary.mil
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe

Jinniyah,

Glad all is well





Here are some free programs and tips for keeping your system up to date, and to help keep all the riff raff out of your system.

Be sure to follow the instructions for System Restore because everything we removed is backed up in that program and if you ever use it to revert your system to an earlier date, you can reinfect your self all over again.


Download and Install CCleaner
* Click on Run Cleaner
* Run the Issues Scan < When it asks you to backup the Registry..Say Yes
Tutorial for CCleaner


Now that your clean, we need to erase all possible older infected files that may still be lurking on your system.
* Clean out your TEMP FILES
* This procedure should be run from SAFEMODE for better results.

To Enter SAFEMODE

* Go to START/ SHUT OF YOUR COMPUTER/ RESTART
* As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly, this will bring up a menu.
* Use the UP AND DOWN ARROW KEYS to scroll up to SAFEMODE
* Then press the ENTER KEY ON YOUR KEYBOARD

* Go to My Computer/ C: Drive/ Documents and Settings/ Every User on this Computer Local Settings
and delete all the contents of the Temp Folder and the Temporary Internet Files Folder <–Just the contents, not the folder itself.

* Go to My Computer/ C:/ Windows/ Temp and delete all the contents of the Temp Folder <– But not the temp folder itself.

* Go to My Computer/ C:/ Windows/ Prefetch and remove all the contents of the Prefetch Folder. <–But not the Prefetch folder itself.


NOW RE-BOOT NORMALLY


* Open INTERNET EXPLORER
* Click on the TOOLS MENU
* Then INTERNET OPTIONS
* At the GENERAL TAB (which should be the first tab you are currently on),
* click on the DELETE FILES BUTTON and put a checkmark in DELETE ALL OFFLINE CONTENT.
* Then press the OK BUTTON . This may take quite a while, so do not be alarmed with how long it takes.
* When it is done, your Temporary Internet Files will now be deleted.

Now Empty your Recycle Bin

System Restore makes regular backups of all your settings, if you ever had to use this program to restore your
system to a previous date, you will be infected all over again so we need to clean out the previous Restore Points

Turn off System Restore.

* Right-click My Computer.
* Click Properties.
* Click the System Restore tab.
* Check Turn off System Restore on all Drives.
* Click Apply, and then click OK.

Reboot your System

Turn ON System Restore.

* Right-click My Computer.
* ClickProperties.
* Click the System Restore tab.
* UN-Check Turn off System Restore on all Drives.
* Click Apply, and then click OK.

* Go to Start/ Control Panel/ Performance and Maintenance/ System Restore/ Create a New Restore Point
You can name the restore point anything you like, something that you can remember, You will have to be in Catagory View to see this

* Make sure that your ANTI-VIRUS SOFTWARE is up to date and run a full scan at least once aweek.

* Here are Free Anti-Virus Programs if you need one. Just install one because with AV software…MORE IS NOT BETTER.

AVG Free Edition
AntVir Personal Edition


* Spybot Search and Destroy 1.4
Check for Updates/ Immunize and run a Full System Scan on a regular basis.

* Ad-Aware SE Personal 1.06
Check for Updates and run a Full System Scan on a regular basis.

* Spyware Blaster It will prevent most spyware from ever being installed.

* Spyware Guard It offers realtime protection from spyware installation attempts.

* Win Patrol This program will warn you when any changes are being made to your system and
give you the option to deny the change.

* IE- Spyad IE-Spyad places over 4000 web sites and domains
in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed,
although you will still be able to connect to the sites.

* Firefox Browser
It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use
them both. When it asks you if you want it to be your default browser, say NO and take the checkmark out of the box to ask you again. After you use this
for awhile, you will want to make it your default.

* Thunderbird Mail There companion mail program was highly favored in PCWorld Magazine,
this has a good spam filter and is more secure than Outlook Express.

* Zone Alarm Here is a free Firewall from Zone Labs, I wouldn't
access the internet without it.

* WINDOWS UPDATES - Enable Automatic Updates
Right click on MY COMPUTER/Click on PROPERTIES/ AUTOMATIC UPDATES and put a mark in the radio button
DOWNLOAD UPDATES FOR ME BUT LET ME CHOOSE WHEN TO INSTALL THEM.

* Go to START/ CONTROL PANEL> PERFORMANCE AND MAINTENANCE> REARRANGE ITEMS ON YOUR HARD DISK TO MAKE PROGRAMS RUN FASTER
This is the Windows Disk Defragger, run this maybe once or twice a month to keep your system running good. The first time you run it, it may take awhile.


Thanks for stopping by Tom Coyote