Help please- tried everything else so here is logfile

Please complete the rest of the recommended steps in this Sticky thread < READ ME FIRST: Basic Spyware, Trojan And Virus Removal >

And then after reading rules about HijackThis log posting, post a new HijackThis log AS A ,TXT FILE ATTACHMENT. Do not cut off the top line that shows the HJT version number. Make sure you have version 1.98.2. Read this Sticky thread < Hijack This Tutorial And How To Post Your Log File >

Make sure you shutdown unnecessary applications as required! ALL BROWSER MUST BE CLOSED. You have to much stuff running that should not be when scanning making more work for us.

Do NOT run Hijack This from the Desktop, a temp folder or choose run from the download (i.e., run from the ZIP file like you did). Place it in its own folder, for example C:\Program Files\HJT Correct this immediately.

And just to help speed this work up, before post a new log, have HijackThis fix the following:
R3 - URLSearchHook: (no name) - {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)
O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe (file missing)
O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe (file missing)
O9 - Extra button: Corel Network monitor worker - {C653F33D-B900-4DCB-8945-824589A113EB} - (no file)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {C653F33D-B900-4DCB-8945-824589A113EB} - (no file)
O9 - Extra button: Corel Network monitor worker - {C653F33D-B900-4DCB-8945-824589A113EB} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {C653F33D-B900-4DCB-8945-824589A113EB} - (no file) (HKCU)
O9 - Extra button: Homepage - {E5D6905E-CEA6-49BA-90EE-FED7FB334F6B} - http://bt.yahoo.com (file missing) (HKCU)
O9 - Extra button: BT - {EA386A0C-ABF7-4265-98FF-CF4D4EF7DDCB} - http://www.bt.com (file missing) (HKCU)

 

Make sure you can view hidden file and folders as per the READ ME FIRST thread.

I think you may also have a peper trojan problem.

Please run the following:
http://www.memorywatcher.com/uninst.exe

if you have problems at the above link try this one: http://tools.zerosrealm.com/uninst.exe

Run it while online.
-------------------------
Then go into Control Panel/Add Remove Programs
Look for Delphin Media and remove it (if found)
If there is a Memory Watcher on the list, remove that too.

Now to uninstall the latest variant of peper aka sandboxer trojan run the below:
http://tools.zerosrealm.com/PeperFix.exe


Reboot into safe mode by following instructions here: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406


Now run HijackThis, select the below line and make sure all browser & email windows are closed and click Fix checked

O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE

Delete the below file:
C:\WINDOWS\UpdReg.EXE

Now reboot normal and get a new HijackThis log and post it here as an attachment.

 

Okay one more item to fix using HJT:
O4 - HKLM\..\Run: [Sys29] C:\windows\system32\winaak32.exe

Then again reboot in safe mode and delete:
C:\windows\system32\winaak32.exe

Then let me know how things are working. That should hopefully finish cleaning you up.

 

The below step was not to be performed in safe mode. It was for normal boot. The file deletion was to be performed in safe mode.

Okay one more item to fix using HJT:
O4 - HKLM\..\Run: [Sys29] C:\windows\system32\winaak32.exe

If you get a HJT this log now from normal boot mode, does the above line still appear?
If so fix it, then reboot and delete the file using Windows Explorer. You MUST have viewing of hidden files and folders enabled inorder to find it. Did you do this?