Can't get rid of Maulware

HJT logs must be posted for scans performed in normal boot mode as requested in the READ ME! Also you must not use msconfig to control startups. See the link given in step 7 of the READ ME which explains this. Before attach a new one, please run the steps below which will help fix a few stubborn problems that you have.

Running Spy Sweeper

Attach the spysweeper.txt file log afterwards. Then make sure you are in normal boot mode (without msconfig) and get a new HJT log and attach it so we can work thru the remaining problems.

Also did you put the below in settings in your system yourself?
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 12.242.16.8:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.*.*.*;<local>

 

No! Not yet! We still have more to do as I said in my previous message.

Do you know what the below service is for?
O23 - Service: (null) - Unknown owner - C:\IBI\desktop436\home\bin\tscom300.exe

Make sure viewing of hidden files is enabled (per the tutorial).

Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
C:\WINDOWS\System32\hpsw.exe
C:\WINDOWS\System32\wgse.exe

After killing all the above processes, click "Back".
Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 12.242.16.8:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.*.*.*;<local>
O2 - BHO: Trecker Class - {39C78B50-7E98-4aa0-B007-D83114EA6E0F} - C:\PROGRA~1\Jalmp\jalmp.dll
O4 - HKLM\..\Run: [susse] "C:\WINDOWS\System32\hpsw.exe"
O4 - HKCU\..\Run: [womu] C:\Program Files\Common Files\womu\womum.exe
O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe
O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe
O18 - Filter: text/html - {2F6E85DC-8D2D-4896-8A4F-7DF8A7B1749D} - C:\PROGRA~1\Jalmp\jalmp.dll
O20 - Winlogon Notify: htproc - htproc32.dll (file missing)
O20 - Winlogon Notify: ssldr - C:\WINDOWS\SYSTEM32\ssldr32.dll

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\Program Files\Common Files\VCClient <--- the whole folder
C:\Program Files\Common Files\womu <--- the whole folder
C:\Program Files\Jalmp <--- the whole folder
C:\windows\system32\ssldr32.dll
C:\windows\system32\htproc32.dll
C:\windows\system32\doser.exe
C:\WINDOWS\System32\hpsw.exe
C:\WINDOWS\System32\wgse.exe

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
Now run Ccleaner (installed while running the READ ME FIRST).

Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

Did you forget to fix these:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank

Or did you not allow the changes to be made when either MS Antispyware and/or Spy Sweeper popped up warning about the changes. You must allow the changes to be made or you must disable the protections of the two programs while making the change.

In fact you must consider whether you want all three of the below installed:
Ewido
MS Antispyware
Spy Sweeper

If you have purchase or plan to purchase Spy Sweeper, I would keep it and uninstall Ewido and MS AS. Having too many full blown applications like this installed can eat up a lot of system resources and slow things down.

 

Does this mean you have purchased Spy Sweeper or will purchase it? Without buying it you will not get updates and it will stop working when the trial ends.

You do not need to do all of those steps. After uninstalling Ewido and MS AS, reboot, and then shutdown Spy Sweeper my right clicking on the icon in the tray and select to exit/close etc. The run HJT and fix those lines. Then Reset Web Settings" in IE.

Then check a new log.

 

Spy Sweeper is the best but you must buy it. If you are looking for a free program then you should uninstall Spy Sweeper and go back to MS Antispyware which is still currently free.

If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

After that, you should work thru the below link:

How to Protect yourself from malware!