Close all (browser) windows & rescan with hijackthis. When the scan is finished place a check in the box to the left of the following entries & click 'fix checked' :
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\twaintec.dll
O2 - BHO: (no name) - {1C4DA27D-4D52-4465-A089-98E01BB725CA} - C:\WINDOWS\System32\inetdctr.dll
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll
O4 - HKLM\..\Run: [alchem] C:\WINDOWS\alchem.exe
O4 - HKLM\..\Run: [intdctrr] C:\WINDOWS\System32\idctup20.exe
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\System32\bridge.dll",Load
O4 - HKLM\..\Run: [etstatn] C:\WINDOWS\System32\etstatn.exe
Reboot into safe mode following the instructions here & navigate to & delete
C:\WINDOWS\alchem.exe< file
C:\WINDOWS\System32\idctup20.exe< file
C:\WINDOWS\System32\etstatn.exe< file
Reboot normally.
Download Registrar Lite from here:
http://www.resplendence.com/download/reglite.exe
Put it in its own folder. You may want to keep this program. It is an excellent free, registry editor.
Copy and paste the follow text into the address bar, then hit 'Go':
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks
In the pane on the right are the values associated with that key.
We want to remove this one>
{CFBFAE00-17A6-11D0-99CB-00C04FD64497}_
Notice the underscore at the end.
Right click on, it and select delete.
If you get a confirmation question, respond OK then close out of the program.
Opera 7.50 is out now & is maybe THE safest browser available. It doesn't look too pretty out of the box but there are over 100 skins available & you can fully customise the way it looks to suit your browsing. You have to put up with an ad on the toolbar inless you purchase it, but I believe there is a tool that you can get to remove it.
Firefox is also a browser that is very secure.
Post a new log when done plz.
