about HSA removal

If you do not find those files, good, but remove the lines anyhow.

I do not understand this line:
"also, when i do run and enter this notepad c:\path\xxxxx.dll,"

Let me know.

 

Please read the information again! You are not following along with the concept of a Generic Solution very well. It tells you in this procedure that everyone's problems are not the same so examples are provided. You have to substitute in your information.

Also you are ignore the NOTE that is part of step 5. It clearly tells you:
"You must replace the generic c:\path\xxxxx.dll will be replaced by the path and filename found in the R0 & R1 lines from your HijaakThis log."

The items list in step 8 are also clearly spelled out to be for the "example" HijackThis log shown at the beginning. They will not necessarily be found in you log but could be. You most likely have other lines in you log with different filenames.

 

No one asked you to post your HJT log (well a partial one anyway) and if we did, they must be a text attachment. Your full log with processes list at the beginning would be important for me to see since you could have processes running that do not show in the startup section (O4) of HijackThis.

From what you gave, these two lines are part of the hijacker:
O2 - BHO: (no name) - {0458C7E1-967D-72B5-37E0-291214822599} - C:\WINDOWS\system32\ntei.dll
O4 - HKLM\..\Run: [appvy.exe] C:\WINDOWS\appvy.exe

Questions not related to HSA:
1) did you install and do you use WildTangent stuff? If not, uninstall it.
2) Who put this into your trusted zones? O15 - Trusted Zone: http://*.hoss.us.tc
Is it a site you recognize?

 

These two processes are part of the hijack and you will need to add them to the deletion list in step 10.
C:\WINDOWS\appvy.exe
C:\WINDOWS\ieds.exe

Did you find the Network Security Service running in step 6? If so, did you disable it and did you note the file name so you can add it to the list to delete?

You should have HijackThis fix the below line too:
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/244a6aa172dfd01e9e05/netzip/RdxIE601.cab