Close all browser windows, restart Hijack This and put a checkmark next to the following entries:
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =
http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
http://searchmiracle.com/sp.php
R3 - URLSearchHook: (no name) - _{20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)
R3 - URLSearchHook: (no name) - {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)
O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\EliteToolBar\EliteToolBar version 59.dll
O2 - BHO: &EliteSideBar - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - C:\WINDOWS\EliteSideBar\EliteSideBar 08.dll
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [btptcpfgqg] C:\WINDOWS\system32\cjjmodsc.exe
O4 - HKLM\..\Run: [lmu] C:\WINDOWS\LMU.exe
O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [NGouwBEd] C:\WINDOWS\wsnwwq.exe
O4 - HKLM\..\Run: [Tsl] C:\PROGRA~1\COMMON~1\tsa\tsl.exe
O4 - HKLM\..\Run: [Fogbe] C:\Program Files\Awfk\Ygkv.exe
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [version] C:\WINDOWS\system32\Ctuvha.exe
O4 - HKLM\..\Run: [30kefsob] C:\Program Files\30kefsob\30kefsob.exe
O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\system32\winupdtl.exe
O4 - HKLM\..\Run: [VBundleOuterDL] C:\Program Files\VBouncer\BundleOuter.EXE
O4 - HKLM\..\Run: [q73S39W] mqcdde.exe
O4 - HKLM\..\Run: [HPNT] C:\Program Files\hpdll\hpdll.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [kalvsys] C:\windows\system32\kalvvnw32.exe
O4 - HKLM\..\Run: [Dvx] C:\WINDOWS\system32\wsxsvc\wsxsvc.exe
O4 - HKLM\..\Run: [vmss] C:\WINDOWS\system32\vmss\vmss.exe
O4 - HKLM\..\Run: [hspszcv] C:\WINDOWS\hspszcv.exe
O4 - HKLM\..\Run: [Windows AdStatus] C:\Program Files\Windows AdStatus\WinStat.exe
O4 - HKCU\..\Run: [sysmonnt] C:\WINDOWS\system32\sysmonnt
O4 - HKCU\..\Run: [bws2RVasl] mprh400.exe
O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.ht m (HKCU)
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -
http://static.windupdates.com/cab/D...e/bridge-c9.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
http://ak.imgfarm.com/images/nocach...etup1.0.0.8.cab
O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} -
http://www.ysbweb.com/ist/softwares...ysb_regular.cab
O16 - DPF: {87067F04-DE4C-4688-BC3C-4FCF39D609E7} -
http://download.websearch.com/Dnl/T_50212/QDow_AS2.cab
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
O23 - Service: ZESOFT - Unknown - C:\WINDOWS\zeta.exe
Click Fix Checked
Then boot into
Safe Mode and ensure that you are showing
Hidden Files and Folders.
Delete the following files and folders:
C:\WINDOWS\
EliteSideBar
C:\WINDOWS\system32\
cjjmodsc.exe
C:\WINDOWS\
LMU.exe
C:\Program Files\
TV Media
C:\Program Files\
Web_Rebates
C:\WINDOWS\
wsnwwq.exe
C:\PROGRA~1\COMMON~1\
tsa
C:\Program Files\
Awfk
c:\temp\
salm.exe
C:\WINDOWS\system32\
Ctuvha.exe
C:\Program Files\
30kefsob
C:\WINDOWS\system32\
winupdtl.exe
C:\Program Files\
VBouncer
C:\WINDOWS\system32\
mqcdde.exe
C:\WINDOWS\
isrvs
C:\windows\system32\
kalvvnw32.exe
C:\WINDOWS\system32\
wsxsvc
C:\WINDOWS\system32\
vmss
C:\WINDOWS\
hspszcv.exe
C:\Program Files\
Windows AdStatus
C:\WINDOWS\system32\
sysmonnt
C:\WINDOWS\system32\
mprh400.exe
C:\Program Files\
Web_Rebates
C:\Program Files\
Ebates_MoeMoneyMaker
C:\WINDOWS\
zeta.exe
Reboot and post a fresh log