MALWARE/Hijacker

If you have followed ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal and you are still having a problem, do the below.

Make sure you have HJT Version 1.98.2 and follow the guidelines on where to install it and how to post a log as an attachment. This is all covered in the sticky thread NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

Now post a HijackThis as a .txt file attachment to your message. All running programs should be closed, including your web browser, e-mail. Close before running Hijack This!

To repeat: Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file. Place it in its own folder, for example C:\Program Files\HJT

 

As Kodo said, you have a load of problems.

Make sure you have system restore disabled and viewing of hidden files enabled.
Please bring up Task Manager by hitting CTRL-ALT-DEL and click the Processes tab. Find the below processes and End them:
sncntr.exe
evthtm.exe
netdllex.exe


Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://find-on-the-net.com/search.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.findin.org/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.evcforum.net/cgi-bin/forumdisplay.cgi?action=listalltopics
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.findin.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.searchv.com/w/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.evcforum.net/cgi-bin/forumdisplay.cgi?action=listalltopics
R3 - Default URLSearchHook is missing
F3 - REG:win.ini: run=c:\windows\system32\netdllex.exe
O2 - BHO: IE Search Toolbar Helper - {2C5175A2-ADF3-4F57-AB70-BA90FD60A383} - C:\Program Files\IESearchToolbar\IESearchToolbar.dll
O3 - Toolbar: (no name) - {00000000-0000-0000-0000-000000000001} - (no file)
O4 - HKLM\..\Run: [win32info] c:\windows\system32\win32info.exe /noconnect
O4 - HKLM\..\Run: [Mscnt] c:\windows\system32\mscnt.exe /nocomm
O4 - HKLM\..\Run: [sncntr] c:\windows\system32\sncntr.exe /nocomm
O4 - HKLM\..\Run: [WeatherOnTray] C:\Program Files\Hotbar\bin\4.4.8.0\WeatherOnTray.exe
O4 - HKLM\..\Run: [EvtHtm] c:\windows\system32\evthtm.exe /nocomm
O4 - HKLM\..\Run: [Mqinx] c:\windows\system32\mqinx.exe
O4 - HKLM\..\Run: [Netdllex] c:\windows\system32\netdllex.exe
O4 - HKCU\..\Run: [Svcinfo] c:\windows\system32\svcinfo.exe
O4 - HKCU\..\Run: [Pwr32ctr] c:\windows\system32\pwr32ctr.exe
O4 - HKCU\..\Run: [Bluecol] c:\windows\system32\bluecol.exe
O4 - HKCU\..\Run: [Pwr32ctrl] c:\windows\system32\pwr32ctrl.exe
O4 - HKCU\..\Run: [Audiodrv] c:\windows\system32\audiodrv.exe
O4 - HKCU\..\Run: [Mqinx] c:\windows\system32\mqinx.exe
O4 - HKCU\..\Run: [Netdllex] c:\windows\system32\netdllex.exe



Boot into safe mode and use Windows Explorer to delete:

C:\windows\system32\sncntr.exe
C:\windows\system32\evthtm.exe
C:\WINDOWS\system32\netdllex.exe
C:\Program Files\IESearchToolbar <- the whole directory
C:\Program Files\Hotbar <- the whole directory
c:\windows\system32\win32info.exe
c:\windows\system32\mscnt.exe
c:\windows\system32\sncntr.exe
c:\windows\system32\mqinx.exe
c:\windows\system32\svcinfo.exe
c:\windows\system32\pwr32ctr.exe
c:\windows\system32\bluecol.exe
c:\windows\system32\pwr32ctrl.exe
c:\windows\system32\audiodrv.exe


No reboot in normal mode and post a new HJT log. And tell us how things are working.

 

The below two items are still in your log:
O3 - Toolbar: IE Search Toolbar - {EB381422-F797-4A98-A266-9DC490821907} - C:\Program Files\IESearchToolbar\IESearchToolbar.dll (file missing)
O4 - HKLM\..\Run: [win32info] c:\windows\system32\win32info.exe /noconnect


Repeat the parts of my previous procedure mentioning them.

 

Okay you log is clean now. What Kodo is point you to includes all the things you should be doing to protect your system. It includes my preferences for antivirus program. Avast is my first choice.