Your machine is more than a bit of a mess, I'm afraid; you've got signs of several different infections in your HJT log.
Please do the following:
You will need to close/quit all web browser programs and disconnect from the Internet for much of the following, so you should print out these instructions or save them into a text file with Notepad.
1. Open your Add/Remove Programs control panel and uninstall any and all programs related to the following:
Altnet
TopSearch
Points Manager
RXToolbar
InstaFinder/InstaFink
BestOffers/The Best
Need2Find
iWon
ToolBar888/MaxFiles/FreeProd/MyToolBar
DollarRevenue
Registry Defender Trial
P2P networking
The Weather Channel/Desktop Weather
PuritySCAN By OIN/OuterInfo/Snowballwars
Unless you've already paid $$ for them (and I hope you haven't), uninstall all of the 3b Software packages (Windows Clean-Up Pro, RegistryRepairPro.exe 4, etc.). The 3b company has a less-than-honorable history, to say the least.2. Download and install the most current updates for your McAfee antivirus.
3. Download the following utilities and save them to your desktop or another convenient folder:
ATF-Cleaner
ewido Anti-spyware (30-day trial version)
* Install and Configure ewido:Close all other Applications and then run the ewido installer
Select language click Ok
Click I Agree
Click next
Click Install
Click Finish
Wait Ewido will open main screen automatically.
Wait again a few minutes and Ewido Should Auto update itself. If it doesn't click update at top of screen.
It is very important to get the updates
When updating has finished, close Ewido.
4. Close all open programs/windows, (especially web browsers). Run another HijackThis scan, put a check in the boxes to the left of the following entries, and then click the "Fix Checked" button:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.comcast.net/toolbar2.0/search/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.comcast.net/toolbar2.0/search/
2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\Program Files\Need2Find\bar\1.bin\ND2FNBAR.DLL (file missing)
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL (file missing)
O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll (file missing)
O2 - BHO: iWon Co-Pilot BHO - {C298FB42-E3E2-11D3-ADCD-0050DAC24E8F} - C:\Program Files\iWon\iWonBar\1.bin\IWONBAR.DLL (file missing)
O3 - Toolbar: Morpheus Toolbar - {119DBEDA-9c41-4F97-94B4-B6BCD01133CF} - (no file)
O3 - Toolbar: (no name) - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - (no file)
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL (file missing)
O3 - Toolbar: i&Won Co-Pilot - {CA0B9B71-C2AF-11D3-B376-0800460222F0} - C:\Program Files\iWon\iWonBar\1.bin\IWONBAR.DLL (file missing)
O4 - HKLM\..\Run: [p2p networking] C:\WINNT\system32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [keyboard] C:\\kybrddd_6.exe
O4 - HKLM\..\Run: [defender] C:\\dfndrdd_6.exe
O4 - HKLM\..\Run: [AltnetPointsManager] C:\Program Files\Altnet\Points Manager\Points Manager.exe -s
O4 - HKLM\..\Run: [Windows Clean-Up Pro] C:\PROGRA~1\3BSOFT~1\WINDOW~2\WINDOWS CLEAN-UP PRO.Exe
O4 - HKLM\..\RunServices: [p2p networking] p2pnetworking.exe
O4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock\tclock_install.exe
O4 - HKCU\..\Run: [tbon] C:\Program Files\TBONBin\tbon.exe /r
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\Run: [Registry Defender] "C:\Program Files\Registry Defender Trial\RegistryDefender.exe"
O4 - HKCU\..\Run: [Windows Registry Repair Pro] C:\Program Files\3B Software\Windows Registry Repair Pro\RegistryRepairPro.exe 4
O4 - HKCU\..\RunOnce: [RXToolBar] regsvr32 /s "C:\Program Files\RXToolBar\RXToolBar.dll"
O9 - Extra button: Morpheus Toolbar - {119DBEDA-9c41-4F97-94B4-B6BCD01133CF} - (no file)
O9 - Extra 'Tools' menuitem: Morpheus Toolbar - {119DBEDA-9c41-4F97-94B4-B6BCD01133CF} - (no file)
O10 - Broken Internet access because of LSP provider 'c:\program files\google\google desktop search\googledesktopnetwork1.dll' missing
O16 - DPF: {70522FA2-4656-11D5-B0E9-0050DAC24E8F} (iWon Progressive Counter) - http://cc.iwon.com/ct/pm3/iwonpm_12_1,0,2,5.cab
O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll
O20 - AppInit_DLLs: C:\WINNT\system32\wowexec.dll C:\WINNT\system32\spool32.dll
Close HijackThis after the fixes complete.
4. Reboot your computer in Safe Mode by doing the following :Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Log in to the Administrator account.
Once booted in to Safe Mode:
* Run ATF-Cleaner
- Double-click ATF-Cleaner.exe to open the program.
- Under Main choose: Select All
- Click the Empty Selected button.
If you use Firefox browser : Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser: Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
* Run a full system scan with your antivirus program; have it fix all malicious items it finds.
* Open ewidoClick on scanner at the top of the Ewido sceen
Click on Settings
Under How to Act click on Recommended Action choose Delete.
Under How to scan, all boxes should be selected
Under Possibly unwanted software, all boxes should be selected
On right side under Reports: click on Automatically generate report after every scan.
Under What to scan, select scan every file
Clickon the Scan Tab
Click on Complete system scan
Let the program scan the machine It can take awhile give it time.
When scan has finished At bottom of screen click Apply all Actions
Click Save report
Click Save Report as (Save as window's screen should pop up.)
Click desktop
Click Save
Exit ewido
* Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files" and "Hide extentions for known file types".
- Search for and delete the following files if they still exist:
kybrddd_6.exe
dfndrdd_6.exe
C:\WINNT\system32\spool32.dll
C:\WINNT\system32\wowexec.dll
- Delete the following folders entirely:
C:\Program Files\Need2Find
C:\Program Files\RXToolBar
C:\Program Files\iWon
C:\WINNT\system32\P2P Networking
C:\Program Files\Altnet
C:\Program Files\3BSoftware
* Empty your Recycle Bin and reboot normally.
5. Run HijackThis again, and post the new log. Also post the log that ewido generated.
