Pop-ups

Hi I'm Angelfire777 and it'll be my pleasure to assist you in your problem. Reasearching Hijackthis logs could take sometime so please, be patient while I research a fix for you. Also, I have to let experts check my fixes first before bringing them to you. Please observe these while we work: 1.) Please stick with this thread until we are finished, do not start a new topic here or start a new thread at other forums. Do not worry, We were trained to help and never give up until we get you all fixed up. 2.) Stop if you have questions!! Never proceed if something is unclear to you. We don't want to start all over again. 3.) Avoid downloading other applications or other anti-spyware programs unless you really need to. 4.) Lastly, please be patient and never lose hope. Sometimes, it will take us several tries and posts to get something done. Sit back tight, I'll be back for you!

1.) You have executed HijackThis directly from the zip file which means that the backups that it makes will not be saved. We need to move Hijackthis.

To move Hijackthis:

• Double-click your Hijackthis.zip file and a window will open showing the HijackThis file. On the left pane, click on the link that says Extract all files.
• The Extraction Wizard will open, click on Browse.
• This will take you to a Select a Destination Window. Click on the (+) sign beside My computer and when it collapses, click C:\ to highlight it.
• Click on Make New Folder. You can name your folder HJT or hijackthis or whatever you want, then click OK
• The Hijackthis program will extract to your new folder and you will see the Extraction Complete window. Put a checkmark in the Show extracted files box and then click Finish.
• The HijackThis folder will open to show the HijackThis program.

You can run hijackthis from its new location but if you find it more convenient to run it from your desktop, right-click HijackThis.exe and select Send To from the options and then choose Desktop (create shortcut).


2.) Go to control panel > add/remove programs > Uninstall the items in bold if found.

1. LimeWire
This program could probably be the reason why you are having some malware troubles. Having a P2p program on your machine is like playing with fire. I strongly suggest you remove that one.

2. Internet Optimizer


Reboot


3.) Please download Brute Force Uninstaller.
Unzip it to it’s own Folder (c:\BFU)

RIGHT-CLICK HERE and choose "Save As" (in IE it's "Save Target As") in order to download Alcra Remover.

Save it in the folder you made earlier (c:\BFU).
Open My Computer and navigate to the c:\BFU folder.

Start the Brute Force Uninstaller by doubleclicking BFU.exe.
In the 'Scriptline to execute' field, copy and paste:

c:\bfu\alcanshorty.bfu
Press Execute and let it do it’s job.
Wait for the complete script execution box to pop up and press OK.
Press exit to terminate the BFU program.


4.) Reboot


5.) Download combofix.exe

1. Double click combofix.exe & follow the prompts.
2. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


On your next reply, please include:

• A Fresh Hijackthis log
• combofix log
• A detailed description on how your computer is behaving

Hijackthis needs to be in its own folder:

a.) While in your Desktop, right click in the background > Go to New > click Folder > Name the Folder HJT

b.) After creating the folder, find your Hijackthis.exe (it looks like a detonator with some dynamites). Then, drag and drop that file to the new folder you created.


1.) Create a folder in the root of your C: drive and name it Blacklight.
A brief explanation of how to do this can be found HERE.

2.) Download F-Secure's BlackLight from HERE and save it into the folder you just created.

3.) Log off from the internet and disconnect your modem cable.

4.) Go to Start > Run, copy and paste the following into the Text Box and hit OK:
"C:\Blacklight\blbeta.exe" /expert

The F-Secure Blacklight Beta window should open.

• Accept the agreement and click OK.
• Click the Scan button to begin.
• Leave the PC idle while the scan takes place.
• When it has completed, click the Close button.
• A text file, fsbl-date/time, will be saved in the Blacklight folder, copy and paste this into your next post.

Download Gmer from here:
http://www.gmer.net/gmer.zip

• Disconnect from internet and close running programs.
• There is a small chance this application may crash your computer so save any work you have open.
• Double click gmer.exe
• Let the gmer.sys driver load if asked.
• If it gives you a warning at program start about rootkit activity and asks if you want to run scan…say Ok.
• If no warning….
• Click "Rootkit" tab and click "Scan"
• Once donem click "Copy"
• Open Notepad and hit "ctrl+v" to paste the log.
• Reconnect to the internet and post the log back to this thread please.

On your next reply, please include:

• Blacklight log
• Gmer log

Download haxfix.exe
and save it to your desktop.

• Double click on haxfix.exe to install haxfix. (standard installation path is c:\program Files\haxfix)
• Checkmark "Create a desktop icon"
• Click "Next"
• When the installation is completed, make sure that the checkmark "Launch HaxFix" is placed
• Click "Finish"

A red "dos window" (dos box) will open with options:
1. Make logfile
2. Run auto fix
3. Run manual fix
E. Exit Haxfix

• Select option 1. Make logfile by typing 1 and then pressing Enter
• Haxfix will start scanning the computer. When it is finished a logfile will open: haxlog.txt
• Copy the contents of that logfile and paste it into this thread. (c:\haxfix.txt)

HAXFIX logfile - by Marckie ______________ version 4.21 06-10-10 12:30:47.65 checking for haxdoor ——————– checking for a3d files…. a3d files not found checking for matching notify keys…. no matching notify keys found checking for matching services…. matching services found ASPI32 CmBatt checking for matching safeboot services…. no matching safeboot services found checking for other haxdoorfiles…. Checking for goldun ——————- checking for SSODL keys…. no ssodl keys found checking for notify keys…. scsiusr4 checking for services…. scsipsrvc checking for other goldunfiles…. Finished Here is the log

Option 2: Autofix

• Double click on My Computer -> C:\ -> Program Files > haxfix and double click on fix.bat (or double click on fix.bat desktop icon)
• Close all other open windows since this step requires a reboot
• Select option 2. Run auto fix by typing 2 and then pressing Enter

If an infection is found, you'll get a message to close all other open windows.

• Close all open windows except the red dos window from haxfix and then press Enter
• The computer will reboot
• After reboot a logfile will open > (c:\haxfix.txt)
• Post the contents of that logfile along with a new HijackThis log.

]

1. Hijackthis needs to be in its own folder:

a.) While in your Desktop, right click in the background > Go to New > click Folder > Name the Folder HJT

b.) After creating the folder, find your Hijackthis.exe (it looks like a detonator with some dynamites). Then, drag and drop that file to the new folder you created.


2. Go to control panel > add/remove programs > Uninstall the items in bold if found.

1. WebHancer

2. Ares
Although Ares is a clean P2P program as listed HERE. Having a P2P program on your system is like playing with fire. But then again, the program above is an optional and it is your call if you want to remove it or not.

Reboot

Delete this folder:

C:\program files\webhancer

Delete the following folder if you have decided to uninstall Ares:

C:\Program Files\Ares

Empty your recycle bin.


3. Please download Brute Force Uninstaller.
Unzip it to it’s own Folder (c:\BFU)

RIGHT-CLICK HERE and choose "Save As" (in IE it's "Save Target As") in order to download Alcra Remover.

Save it in the folder you made earlier (c:\BFU).
Open My Computer and navigate to the c:\BFU folder.

Start the Brute Force Uninstaller by doubleclicking BFU.exe.
In the 'Scriptline to execute' field, copy and paste:

c:\bfu\alcanshorty.bfu
Press Execute and let it do it’s job.
Wait for the complete script execution box to pop up and press OK.
Press exit to terminate the BFU program.

Reboot

4. Download combofix.exe

1. Double click combofix.exe & follow the prompts.
2. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

Robyn - 06-10-14 14:06:41.61 Service Pack 2 ComboFix 06.10.14 - Running from: "C:\Documents and Settings\Robyn\Desktop" ((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log )))))))))))))))))))))))))))))))))))))))))))))))))) REGISTRY ENTRIES REMOVED: [HKEY_CLASSES_ROOT\clsid\{457A1A48-21EA-450D-8924-CBDF6D334C7C}] @="" [HKEY_CLASSES_ROOT\clsid\{457A1A48-21EA-450D-8924-CBDF6D334C7C}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\clsid\{457A1A48-21EA-450D-8924-CBDF6D334C7C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\clsid\{457A1A48-21EA-450D-8924-CBDF6D334C7C}\InprocServer32] @="C:\\WINDOWS\\system32\\MBACM32.DLL" "ThreadingModel"="Apartment" * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * FILES REMOVED: C:\WINDOWS\SYSTEM32\AZMPARSE.DLL C:\WINDOWS\SYSTEM32\cqmpatUI.dll C:\WINDOWS\SYSTEM32\dnn6015se.dll C:\WINDOWS\SYSTEM32\en86l1ls1.dll C:\WINDOWS\SYSTEM32\fn4021hmg.dll C:\WINDOWS\SYSTEM32\fp6m03j1e.dll C:\WINDOWS\SYSTEM32\h00qlad51d0.dll C:\WINDOWS\SYSTEM32\iN06lgds1606.dll C:\WINDOWS\SYSTEM32\irjql5151.dll C:\WINDOWS\SYSTEM32\lv4o09h3e.dll C:\WINDOWS\SYSTEM32\m4rm0e91eh.dll C:\WINDOWS\SYSTEM32\MBACM32.DLL C:\WINDOWS\SYSTEM32\MJDART.DLL C:\WINDOWS\SYSTEM32\MWC71FRA.DLL C:\WINDOWS\SYSTEM32\MYGLIBNT.DLL C:\WINDOWS\SYSTEM32\OODBSE32.DLL C:\WINDOWS\SYSTEM32\PKUTOENR.DLL C:\WINDOWS\SYSTEM32\SFBCSP.DLL C:\WINDOWS\SYSTEM32\t6r8lg9u16.dll C:\WINDOWS\SYSTEM32\wfspdmod.dll C:\WINDOWS\SYSTEM32\WHSDMOE.DLL Granting sedebugprivilege to Administrators … successful ((((((((((((((((((((((((((((((((((((((((((( E-Give / Ssk's Log ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\dxclib303562752.dll C:\Documents and Settings\Robyn\Application Data\Dxccwrd.dll C:\Documents and Settings\Robyn\Application Data\Dxcknwrd.dll C:\WINDOWS\system32\bkd.exe C:\Program Files\DeluxeCommunications\Dxc.exe C:\Program Files\DeluxeCommunications\DxcBho.dll C:\Program Files\DeluxeCommunications\DxcCore.dll * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * C:\WINDOWS\system32\dxclib303562752.dll C:\Program Files\DeluxeCommunications\Dxc.exe C:\Program Files\DeluxeCommunications\DxcBho.dll (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Documents and Settings\LocalService\Application Data\NetMon C:\Program Files\network monitor C:\Program Files\PrintView C:\Program Files\Common Files\{3092FE59-0AED-1033-0820-040203200001} ((((((((((((((((((((((((((((((( Files Created from 2006-09-14 to 2006-10-14 )))))))))))))))))))))))))))))))))) 2006-10-12 12:03 234,272 -r–s—- C:\WINDOWS\SYSTEM32\DVPRPRES.DLL 2006-10-10 12:30 90,112 –a—— C:\WINDOWS\SYSTEM32\RegDACL.exe 2006-10-10 12:30 7,483 –a—— C:\clean.bat 2006-10-10 12:30 40,960 –a—— C:\WINDOWS\SYSTEM32\swsc.exe 2006-10-10 12:30 4,096 –a—— C:\WINDOWS\SYSTEM32\reboot.exe 2006-10-10 12:30 38,400 –a—— C:\WINDOWS\SYSTEM32\moveex.exe 2006-10-09 23:20 50,912 –a—— C:\WINDOWS\iconu.exe 2006-10-09 20:45 42,736 –a—— C:\WINDOWS\icont.exe 2006-10-09 20:31 178,408 –a—— C:\WINDOWS\SYSTEM32\muweb.dll 2006-10-09 20:31 127,208 –a—— C:\WINDOWS\SYSTEM32\mucltui.dll 2006-10-05 15:47 96,768 ——— C:\WINDOWS\SYSTEM32\dxclib303562752.dll 2006-10-05 15:46 32,768 –a—— C:\DXC9.exe 2006-10-04 18:47 578,560 –a—— C:\Installer4.exe 2006-10-04 18:47 1,024 –a—— C:\ppjp.exe 2006-10-04 18:46 53,120 –a—— C:\WINDOWS\srvzlohatq.exe 2006-10-04 18:46 24,674 –a—— C:\mfxxdv.exe 2006-10-04 18:46 217,276 –a—— C:\WINDOWS\srviiffwvm.exe 2006-10-04 18:45 1,024 –a—— C:\wqjbtp.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-10-14 14:11 ——– d——– C:\Program Files\DeluxeCommunications 2006-10-14 14:08 ——– d——– C:\Program Files\Common Files 2006-10-13 13:18 ——– d——– C:\Program Files\DC++new 2006-10-12 16:56 ——– d——– C:\Program Files\HaxFix 2006-10-09 16:34 ——– d——– C:\Program Files\Windows Live Toolbar 2006-10-09 16:33 ——– d——– C:\Program Files\Common Files\Microsoft Shared 2006-10-09 16:32 ——– d——– C:\Program Files\MSN Messenger 2006-10-06 13:34 ——– d——– C:\Program Files\LimeWire 2006-10-04 18:46 ——– d——– C:\Program Files\MSN 2006-10-04 18:46 ——– d——– C:\Program Files\ComPlus Applications 2006-09-21 10:10 ——– d——– C:\Program Files\Virtual Laguna Beach 2006-09-20 16:04 ——– d——– C:\Documents and Settings\Robyn\Application Data\Google 2006-09-20 10:02 ——– d——– C:\Program Files\Google 2006-09-13 00:01 1084416 –a—— C:\WINDOWS\SYSTEM32\msxml3.dll 2006-09-12 19:10 ——– d–h—– C:\Program Files\InstallShield Installation Information 2006-08-25 10:45 617472 –a—— C:\WINDOWS\SYSTEM32\comctl32.dll 2006-08-23 12:36 ——– d——– C:\Program Files\Dell AIO Printer A920 2006-08-21 07:21 16896 –a—— C:\WINDOWS\SYSTEM32\fltlib.dll 2006-08-21 04:14 23040 –a—— C:\WINDOWS\SYSTEM32\fltmc.exe 2006-08-21 04:14 128896 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\fltmgr.sys 2006-08-16 06:58 100352 –a—— C:\WINDOWS\SYSTEM32\6to4svc.dll 2006-08-16 04:37 225664 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\tcpip6.sys 2006-08-14 05:34 332928 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\srv.sys 2006-08-14 03:02 ——– d——– C:\Program Files\Internet Explorer 2006-07-29 19:32 48936 –a—— C:\WINDOWS\SYSTEM32\sirenacm.dll 2006-07-27 08:24 679424 –a—— C:\WINDOWS\SYSTEM32\inetcomm.dll 2006-07-21 03:24 72704 –a—— C:\WINDOWS\SYSTEM32\hlink.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background" "DellSupport"="\"C:\\Program Files\\Dell Support\\DSAgnt.exe\" /startup" "ares lite"="\"C:\\Program Files\\Ares\\Ares.exe\" -h" "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.0.720.3640\\GoogleToolbarNotifier.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" "SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe" "dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe" "UpdateManager"="\"C:\\Program Files\\Common Files\\Sonic\\Update Manager\\sgtray.exe\" /r" "PCMService"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\"" "DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\"" @="" "DadApp"="C:\\Program Files\\Dell\\AccessDirect\\dadapp.exe" "Dell QuickSet"="C:\\Program Files\\Dell\\QuickSet\\quickset.exe" "Dell AIO Printer A920"="\"C:\\Program Files\\Dell AIO Printer A920\\dlbkbmgr.exe\"" "vptray"="C:\\PROGRA~1\\SYMANT~1\\SYMANT~1\\vptray.exe" "BCMSMMSG"="BCMSMMSG.exe" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_04\\bin\\jusched.exe" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "igfxtray"="C:\\WINDOWS\\system32\\igfxtray.exe" "igfxhkcmd"="C:\\WINDOWS\\system32\\hkcmd.exe" "igfxpers"="C:\\WINDOWS\\system32\\igfxpers.exe" "sys09814939737"="C:\\WINDOWS\\sys09814939737.exe" "SvcManager"="kernell6.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="C:\\Program Files\\MSN\\xunyhyhi.html" "SubscribedURL"="" "FriendlyName"="" "Flags"=dword:00002000 "Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,e8,\ 03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00 "CurrentState"=hex:01,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\ 00,00,01,00,00,00 "RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1] "Source"="C:\\Program Files\\Common Files\\vilo.html" "SubscribedURL"="" "FriendlyName"="" "Flags"=dword:00002000 "Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,ea,\ 03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00 "CurrentState"=hex:01,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\ 00,00,01,00,00,00 "RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,00 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\2] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\ 00,00,01,00,00,00 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job C:\WINDOWS\tasks\ISP signup reminder 1.job Completion time: 06-10-14 14:11:30.62 C:\ComboFix.txt … 06-10-14 14:11 C:\ComboFix2.txt … 06-10-06 13:46

Go to Control Panel > Add/Remove programs > uninstall the items in bold if found.

1. LimeWire
This program could probably be the reason why you are having some malware troubles. Having a P2p program on your machine is like playing with fire. I strongly suggest you remove that one.


Still in Control Panel, double click Display Properties > Desktop > Customize Desktop… > Web tab
Uncheck and Delete everything you find in there. (Except for "My Current Home Page.")

Reboot

You may need to see your Hidden Files first.

Windows XP

• Click Start.
• Open My Computer..
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the "Hidden files and folders" heading select Show hidden files and folders.
• Uncheck the Hide Protected Operating System Files Option.
• Click Yes to confirm.
• Click OK.

Open Windows Explorer by hitting your Windows Key + E at the same time.
*If you do not have a Windows Key, double click My Computer > Click the folders icon

Then navigate to these files and delete them:

C:\ppjp.exe
C:\Installer4.exe
C:\WINDOWS\srvzlohatq.exe
C:\mfxxdv.exe
C:\WINDOWS\srviiffwvm.exe
C:\wqjbtp.exe
C:\DXC9.exe
C:\WINDOWS\SYSTEM32\dxclib303562752.dll
C:\WINDOWS\icont.exe
C:\WINDOWS\iconu.exe
C:\WINDOWS\SYSTEM32\DVPRPRES.DLL

Then navigate to these folders and delete them:

C:\Program Files\DeluxeCommunications

Delete the following folder if you decided to uninstall LimeWire:

C:\Program Files\LimeWire

Empty your recycle bin.

Open notepad. It must be notepad, not wordpad.
Copy and paste the text inside the quote box below into notepad, including the blank line at the end.
Choose file save as and set file type to all files.
Type fixreg.reg in the file name and save it to your desktop.

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"sys09814939737"=-
"SvcManager"=-

Make sure there are NO blank lines before REGEDIT4
Make sure there IS one blank line at the end of the file.

Close notepad. Make sure that all windows are closed.

Find the fixreg.reg file on your desktop.
Double click it.
It will then ask if you want the file merged to your registry.
Answer Yes.

Reboot

Please post a fresh HiJackThis log and please tell us how your computer is behaving also please let me know if there are any files/folders that you can't delete.

Go to Control Panel > Add/Remove programs > uninstall the items in bold if found.

DeluxeCommunications

Please uninstall the following program if you are not using it.

Empire Poker

Reboot

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/

• Install AVG Anti-Spyware by double clicking the installer.
• Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
• On the main screen under Your Computer's security.
  • Click on Change state next to Resident shield. It should now change to inactive.
  • Click on Change state next to Automatic updates. It should now change to inactive.
  • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
  • Wait until you see the Update succesfull message.
• Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
• Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.

Download ATF Cleaner by Atribune

DO NOT USE IT YET!!


Open Hijackthis > choose Scan Only > Place a checkmark in the boxes beside these entries in bold.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R3 - URLSearchHook: (no name) - _{A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.drivecleaner.com/.freeware/inst…leanerstart.cab
O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} (Progetto1.int_ver34) - http://advnt01.com/dialer/int_ver34.CAB
O16 - DPF: {E055C02E-6258-40FF-80A7-3BDA52FACAD7} (Installer Class) - http://activex.matcash.com/speedtest2.dll
O20 - AppInit_DLLs: dxclib303562752.dll

If you decided to uninstall Empire Poker, please fix the following lines.

O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)

Close your browsers and all open windows except for Hijackthis, then click "Fix Checked."

You may want to print these instructions here or save them in notepad since you'll work offline.

Reboot into Safe Mode.

To enter Safe Mode..

Click Start > Turn Off Computer > Restart > Tap F8 key just before Windows starts to load, > This will bring up a Menu > Use your keyboard to scroll to Safe Mode> Hit enter.

Using Windows Explorer, delete this file:

C:\WINDOWS\SYSTEM32\dxclib303562752.dll

Delete this folder too:

C:\Program Files\DeluxeCommunications

Delete the following folder if you have decided to uninstall Empire Poker.

C:\Program Files\Empire Poker

Empty your recycle bin.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose:Select All
• Click the Empty Selected button.
• NOTE: If you would like to keep your saved passwords, please click
• No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
• NOTE:If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.

• Click on Scanner on the toolbar.
• Click on the Settings tab.
  • Under How to act?
    • Click on Recommended Action and choose Quarantine from the popup menu.
  • Under How to scan?
    • All checkboxes should be ticked.
  • Under Possibly unwanted software:
    • All checkboxes should be ticked.
  • Under Reports:
    • Select Automatically generate report after every scan and uncheck Only if threats were found.
  • Under What to scan?
    • Select Scan every file.
• Click on the Scan tab.
• Click on Complete System Scan to start the scan process.
• Let the program scan the machine.
• When the scan has finished, follow the instructions below.
  IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
  • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
  • At the bottom of the window click on the Apply all Actions button. (3)
• When done, click the Save Scan Report button. (4)
  • Click the Save Report as button.
  • Save the report to your Desktop.
• Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

Reboot in Normal Mode.

After that, please post a fresh Hijackthis log along with an AVG Antispyware log