Any help would be greatly appreciated

Looks like you did not run about:Buster or did you? Please attach the log if you ran it.
If you did not run it then download it and run it twice with a reboot inbetween runs. Make sure you are offline with no browsers opened while running it.

 

Viewing of hidden files should remain that way. There is no reason to change it back especially while we are still trying to fix your problems. Do not touch System Restore yet.

You need to goto step 7 of the READ & RUN ME an follow the directions exactly for getting HJT installed properly. And only run one session of it. Also make sure you have booted in normal boot mode. You also need to follow the directions there that tell you not to use msconfig to control startups. You must select Normal Startup. Then continue with the below.

The second HJT log still showed infected files. I'm surprised about:Buster or HSremove does not find them. Perhaps the files are gone but not the registry keys for them.


For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {41F3D01F-6C89-A15F-70E9-32BE0CB61C71} - C:\WINDOWS\system32\ntyo32.dll (file missing)
O2 - BHO: Class - {7C061B06-4572-3DED-BEE5-45419ADBBEFC} - C:\WINDOWS\wineu32.dll (file missing)
O2 - BHO: Class - {9101E79D-A1A7-196F-75D9-D469880131A5} - C:\WINDOWS\nethv32.dll (file missing)
O2 - BHO: Class - {92C13A2E-9A7F-21D3-5898-A6A429E0CF01} - C:\WINDOWS\iexr32.dll (file missing)
O2 - BHO: Class - {B32D8461-B24C-D626-990B-16F9A99073D4} - C:\WINDOWS\system32\mfcey.dll (file missing)
O4 - HKLM\..\Run: [apifr.exe] C:\WINDOWS\apifr.exe
O4 - HKLM\..\Run: [msdi32.exe] C:\WINDOWS\system32\msdi32.exe
O4 - HKLM\..\Run: [atlqd.exe] C:\WINDOWS\system32\atlqd.exe

Unless you absolutely require the below TZ entries for work or something, fix them.
O15 - Trusted Zone: http://register-tesco.qa.business.ntl.com
O15 - Trusted Zone: http://memberservices.tesco.net

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete the below if found (some or all may already be gone):
C:\WINDOWS\system32\ntyo32.dll
C:\WINDOWS\wineu32.dll
C:\WINDOWS\nethv32.dll
C:\WINDOWS\iexr32.dll
C:\WINDOWS\system32\mfcey.dll
C:\WINDOWS\apifr.exe
C:\WINDOWS\system32\msdi32.exe
C:\WINDOWS\system32\atlqd.exe

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
Now run Ccleaner (installed while running the READ ME FIRST).

Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

Reminder Note: Once we have determine you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

Have HJT fix the below WildTangent entry:
O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll"

Do you know what the below are?
O4 - HKLM\..\Run: [PCEyeLic] C:\Program Files\PCEye2000\pceye2000.exe
O4 - HKLM\..\Run: [AntivirusRegistration] C:\WINDOWS\System32\EzAntivirusRegistrationCheck.exe

You don't appear to have an antivirus application so I question the above.


You are still using msconfig:

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto




Step 7 of the READ & RUN ME gives you this link:

Downloading, Installing, and Running HijackThis


​

In the above link it states:

Please follow those directions. And post a new HJT log.

 

Try the below to et SpyFighter removed .

Run Ccleaner and click on the Tools button. Now you come to a window with Uninstall highlighted. Click on the SpyFighter entry to select it. Then Click the Delete button on the right side.

Did this work?

 

Try clicking Uninstall instead. Does that work?

 

I don't know what they are but you must keep track of what gets installed on your PC and if not used they should be removed.

Is wavepad this: http://www.softpedia.com/get/Multimedia/Audio/Audio-Editors-Recorders/WavePad.shtml

Look in Start All Programs and see what applications can be run. Sometimes you can find the exact same name as in Add/Remove.

 

Yes it looks like you are all cleaned up. If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

After that, you should work thru the below link:

How to Protect yourself from malware!

 

No problem! Just complete what I gave you in msg # 15.

 

You have to allow iexplore.exe access thru the firewall.

Try ZoneAlarm!. The default setup work pretty well on what it already has allowed access.

 

You're welcome! Surf safely!