Hello
While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.
- Open Spybot Search & Destroy.
- In the Mode menu click "Advanced mode" if not already selected.
- Choose "Yes" at the Warning prompt.
- Expand the "Tools" menu.
- Click "Resident".
- Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
- In the File menu click "Exit" to exit Spybot Search & Destroy.
1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):
O2 - BHO: (no name) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - (no file)
O2 - BHO: (no name) - {0347C33E-8762-4905-BF09-768834316C61} - (no file)
O2 - BHO: (no name) - {07160AD0-4B97-4DC4-9812-E6B52CFE0273} - (no file)
O2 - BHO: (no name) - {166BCB27-FCFD-4588-9BDB-44FC6A02EF35} - (no file)
O2 - BHO: (no name) - {24BDE8A2-C73F-4C3F-81E5-8807B904DB24} - (no file)
O2 - BHO: (no name) - {2F212532-79C6-4A76-B9A5-99859F1EA374} - (no file)
O2 - BHO: (no name) - {325B827E-2F0A-4740-BD12-E5F067350291} - (no file)
O2 - BHO: (no name) - {3AA27849-D02D-4BC1-8D15-777F0F45DF57} - (no file)
O2 - BHO: (no name) - {514A5C49-0C7D-42c3-A71B-38864A269B7A} - (no file)
O2 - BHO: (no name) - {63905D73-EFAF-482E-AFA0-E10D1448AF72} - (no file)
O2 - BHO: (no name) - {65438096-85AC-416B-9273-581B871E7EA9} - (no file)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - (no file)
O2 - BHO: (no name) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {92A44D3D-6D3C-4BB7-B9C3-4D4FF00D0CC0} - (no file)
O2 - BHO: (no name) - {C4735EB0-6097-4EBA-90AF-3DCE0B25E1CA} - (no file)
O2 - BHO: (no name) - {D799AAE1-7A8E-4E08-8BC7-AC9208AE2B1E} - (no file)
O2 - BHO: (no name) - {e3b3af90-b675-4972-bedc-c79ee245bbf6} - (no file)
O2 - BHO: (no name) - {F362EE3A-621A-460C-951E-6051477287D6} - (no file)
O20 - Winlogon Notify: awtsQgFx - C:\WINDOWS\
2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.
Reboot and post a new HijackThis log
