hijack this log...help?

I read the sticky and have completed all the steps...

• Edit by bjgarrick: Unrequested, Inline HJT log removed!

 

No, you have not completed all of the steps!

 

Okay, sorry about that...Here is the completed logs attached. Thanks for your help!!!

 

Before we begin, please relocate your Hijack This so a more secure location, for example

C:\Program Files\HJT

After you relocate, attach a fresh HJT log.

 

Okay, I have attached a new file...

 

Look in Task Manager (Ctrl-Alt-Del) for the following running processes and, if you see any of them, try to END them:

LY41E7.EXE

Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = torproxy:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 10*.*.*;*.softchoice.com;*.3-soft.com,*.softchoice.ca,*.softchoice.net;192.168.* .*;esolutions.right.com;206.245.44.25;aggie.adc.capgemini.com;*.macromedia.com;2 16.52.17.116;

O4 - HKLM\..\RunOnce: [VzCheckSysReg] regsvr32 /s vzchecksys.dll
O4 - HKLM\..\RunOnce: [MotivePreQualReg] regsvr32 /s MotivePreQual.dll

O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe (file missing)

O16 - DPF: {e79bc654-8fc6-4bb9-bfb8-8860779ae213} (Oracle JInitiator 1.1.8.24) -

Again, make sure ALL browser windows are closed when you click FIX.

Next, run CCleaner to clean up cookies and temp files.

Run full scans with Ad-Aware SE & Spybot S&D and have both programs fix what they find.
Note: Remember to get all updates before doing the scans.

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:

• Temporary Files
• Temporary Internet Files
• Recycle Bin

And Click OK.

After you complete the above, REBOOT and proceed with the rest of this fix...

Finally, I would like you to flush your System Restore points. Please follow the instructions in the below:

• Disable and Re-enable System Restore
  
  
• Turn OFF System Restore to flush any bad Restore Points.
  
  
• Then, follow the instructions at the bottom of the linked page to Re-enable the Restore Utility which will create a fresh restore point.

After you complete the above reboot once more and then scan with HijackThis and attach the new log.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Before I start any of this, let me tell you that this is a company laptop. Lenovo refers to the IBM thinkpad I am using and Softchoice is the company I work for. I don't think that I want to delete anything that says softchoice as it probably has something to do with the VPN I connect to. Unless I'm wrong about that and some malware got the company name from inside this laptop and used it to make it look legit... I am running XP pro with service pack 2. I started getting popups after downloading a yahoo toolbar. I'veremoved everything yahoo I could find in the add/remove programs and remnants in the registry of yahoo yet I still get popups. What gives?

 

If you like skip fixing the items with HJT and procede with the rest of the fix.