hijack this please help

Please read step 7 of the READ ME again and follow those directions but see the bottom of this message before posting another HJT log.

​

You need to run the below too and post the smitfiles.txt log as an attachment:

Smitfraud and PSGuard Removal

Then get a new HJT log and attach it make sure you install HJT properly.

These poker sites are a bad idea! I also recommend uninstall and fixing any left overs from these.

 

Let's try this again.

Please read step 7 of the READ ME again and follow those directions but see the bottom of this message before posting another HJT log.

​

Is there some reason that you are not following these instructions. HijackThis is not installed properly and you keep posting your log inline.

You forgot to post the log from SmitRem!

Yes you need a firewall but you already have ZoneAlarm installed. We will discuss this later. But first address the above issue with HJT so we can continue to fix your malware problems. Install HJT properly and then continue with the below.

Did you buy this: C:\Program Files\MalwareSweeper.com\Malware Sweeper\MalSwep.exe
If not, I would uninstall it. I'm not sure of the quality of this program.

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
C:\Program Files\ornu\nslo.exe

After killing all the above processes, click "Back".
Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKCU\..\Run: [Srro] "C:\Program Files\ornu\nslo.exe" -vt mtx
O9 - Extra button: AbsolutePoker.com - {EFFF8D47-D060-4108-B761-E8EC86622E56} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: AbsolutePoker.com - {EFFF8D47-D060-4108-B761-E8EC86622E56} - C:\Documents and Settings\All Users\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\Program Files\ornu <--- the whole folder

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.