1. You need to take care of one thing before we proceed:
C:\Documents and Settings\Admin\Local Settings\Temp\HijackThis.exe
The log entry above indicates that you are running HJT from within a Temp/Temporary folder. Please do the following:
Create a folder outside of any Temp/Temporary folders for HJT and move it there now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.
One of the normal steps in eliminating malicious programs is to entirely delete the contents of all Temp folders. Given that, if HijackThis (and other data that you care about) is living in those Temp folders, it will be erased along with everything else!
Temp/Temporary folders are just that- Temporary. They are not meant for permanent storage, as their contents are often delete in the course of troubleshooting, by running disk clean-up utilities, etc.
2. I see reference (the "010" entry) to the BulletProof "anti-spyware" software in your log; uninstall that program. In addition to the fact that the product itself is of dubious reliability, the Bulletproofsoft company actually partners with known adware distributors and bundles that adware with downloads from the bulletproof.com site.
Before downloading/buying/installing any product touted as an anti-spyware/anti-adware program, you should consult the list of reputable vs. disreputable utilities at the following site:
http://www.spywarewarrior.com/rogue_anti-spyware.htm
3. Download and run LSPFix .
In LSPFix, if you see a file named "apptoport.dll" listed in the left-hand Keep column, put a check in the "I know what I'm doing" box, hilight apptoport.dll, and click the ">>" button to move apptoport.dll to the "Remove" window. Click Finish and then OK to complete the fix.
If you do not see apptoport.dll listed, just click Finish and then OK.
4. You definitely have signs of infection by a variant of the smitfraud family. Please follow the removal instructions at this site .
- In step #10 of the instructions at the site above, include the following file in their list of files to delete:
C:\WINDOWS\System32\hp9C75.tmp
- In step #15 of the instructions at the site above, have HijackThis fix the following entries in your log instead of the example entries given in the instructions:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.updatesearches.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.updatesearches.com/bar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.updatesearches.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.updatesearches.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.updatesearches.com/search.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.updatesearches.com/search.php?qq=%1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.updatesearches.com/
O2 - BHO: (no name) - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\System32\hp9C75.tmp
O9 - Extra button: Microsoft AntiSpyware helper - {CD17F92B-892A-4F9F-8191-47A50B30535C} - C:\WINDOWS\System32\wldr.dll
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {CD17F92B-892A-4F9F-8191-47A50B30535C} - C:\WINDOWS\System32\wldr.dll
5. After completing the above fix, run HJT again and post a new log here.
