You still have more to do.
===============
Go to
Add/Remove programs and remove(uninstall) the following, if present:
EZula Toptext
WhenU
The above could appear anywhere within the entry. Be careful not to remove any
personal or
system software.
===============
Run
HiJackThis, click "
Scan", then check(tick) the following, if present:
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.begin2search.com/sidesearch.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus...rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.begin2search.com/sidesearch.html
R3 - URLSearchHook: (no name) - {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)
O2 - BHO: (no name) - {54AE5E14-A9EE-AF54-FF62-ED8133D3C23E} - C:\WINDOWS\Bvfhifko.dll (file missing)
O3 - Toolbar: (no name) - {52FE5233-367C-4EFB-BDD7-0BE4D212C107} - (no file)
O3 - Toolbar: Search - {5AF95B26-44FB-67F3-E142-79D2D33D5BAB} - C:\WINDOWS\Bvfhifko.dll (file missing)
O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\bxxs5.dll,DllRun
O4 - HKLM\..\Run: [mdjkiang] C:\WINDOWS\System32\tdhfml.exe
O4 - HKLM\..\Run: [Search-Exe] "C:\Program Files\se\v11\se.EXE" /H
O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power Scan\powerscan.exe
O4 - HKCU\..\Run: [ClockSync] C:\Program Files\ClockSync\Sync.exe /q
O4 - HKCU\..\Run: [prutqct] C:\WINDOWS\System32\prutqct.exe
O4 - HKCU\..\Run: [pruttct] C:\WINDOWS\System32\pruttct.exe
O9 - Extra button: Your PC is infected with Spyware - click here to fix your PC - {FB74C951-ACA1-4e33-A94C-A9261EB2CCB7} - https://www.spydeleter.com/order2.php?KBID=1062 (file missing)
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/29458ec...ip/RdxIE601.cab
O23 - Service: Externtelecom - Unknown owner - C:\WINDOWS\extel.exe (file missing)
O23 - Service: Windows Configuration Loader - Unknown owner - C:\WINDOWS\svchost.exe
O23 - Service: Windows Process Moniter - Unknown owner - C:\WINDOWS\winmon.exe (file missing)
Now, close
all instances of Internet Explorer and any other windows you have open except
HiJackThis, click "
Fix checked".
===============
Locate and
delete the following item(s), if present. Make sure you are able to
view system and hidden files/ folders:
folders...
C:\Program Files\se
C:\Program Files\Power Scan
C:\Program Files\ClockSync
files...
C:\WINDOWS\bxxs5.dll
C:\WINDOWS\System32\tdhfml.exe
C:\WINDOWS\System32\prutqct.exe
C:\WINDOWS\System32\pruttct.exe
C:\WINDOWS\svchost.exe
-
Note that some of these file(s)/folder(s) may or may not be present. If present, and cannot be deleted because they're '
in use', try deleting them in "
Safe Mode".
-
Reboot.
===============
To help protect your system from
hostile ActiveX content, or special '
downloadable' files:
Download, install and keep updated,
SpywareBlaster. If you've installed it for the first time:
1) Check for any available updates; if present, they'll be automatically downloaded and installed.
2) Next, "
Enable all protection".
3) Exit the program.
-
Note: Remember to regularly check for updates.
===============
After rebooting, rescan with hijackthis and post back a new log. Please let me know how your pc is now.