Registry is finished Help Disaster Zone here

First a few questions and comments:
1) Please do not attached your HJT logs as .doc files. They do not cut & paste into messages properly and make more work for us. Use the .log file as created by HJT.
2) Did you replace the old Ad-Aware 6 with Ad-Aware SE 1.05?
3) Did you install this OemjiPopupBlocker software?

C:\Program Files\Oemji\Toolbar\PopupBlocker\OemjiPopupBlocker.exe

And why is it running twice?
I also question the validity of this program especially when I see this
http://www.oemji.com/side_search.html
for your search assistant. side_search is known malware.

4) Did you install this CoffeeCup Software?
C:\Program Files\CoffeeCup Software\CoffeeCup Free Zip Wizard\wrapper.exe
C:\Program Files\CoffeeCup Software\CoffeeCup Free Zip Wizard\cczip.exe

I assume cczip.exe is what you use for manipulating compressed files like ZIP but what is wrapper.exe. And why are they running.

5) Normally notepad.exe is found running from c:\windows\system32. Yours is showing in C:\WINDOWS\notepad.exe . You should check to make sure it is really the Microsoft notepad.exe application. And why is it running?

6) If OemjiPopupBlocker is a valid application why do you also have the below running.

C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe

It is not typically useful to have mutliple popup blockers running.

 

Okay so now Oemji should be gone! Right?
What about the other stuff! Please answer all my questions.

And also here are some additional a questions and comments:

1) I see a load of spyware scanner/blocking software. Many of which are rogue/suspect spyware removal programs and should be removed. They may be doing you more harm than good.
- SpySpotter
- Spyware Begone
- if Easy Erase Spyware Remover is really just Spyware Remover, it is rogue too.

Here is a reference for you to look at: http://www.spywarewarrior.com/rogue_anti-spyware.htm

2) Why does this Free_Store_Club shop online software need to be running at startup?
O4 - HKCU\..\Run: [FSCBoss] C:\Program Files\FSCBoss\FSCBoss.exe
I really don't see why this should be necessary. Any site that requires something like that should be questioned.

3) Is there a reason you never ran the Symantec online scan as requested in the READ ME FIRST?

 

To bad you went offline already. I wanted to get a new HJT log after getting all my questions answered and possibly uninstalling some more items. There are addition malware problems in your log we need to work on.

Below are the items that I wanted to work on. It still include the OEMJI stuff because I was not able to get a new log from you before posting this. Maybe the uninstall of OEMJI removed all those lines. Also since I did not get any response yet about the rogue/suspect spyware removal tools, I left them in the HJT log for items to fix. You should try using Add/Remove programs to uninstall them before fixing with HJT.

Also look for IESearchToolbar in Add/Remove programs and uninstall it if found.

Make sure you have system restore disabled and viewing of hidden files enabled (per the tutorial).

Please bring up Task Manager by hitting CTRL-ALT-DEL and click the Processes tab. Look for the below process(es) and if found, End them:
kaka.exe

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.oemji.com/side_search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.oemji.com/side_search.html
F3 - REG:win.ini: load=??
F3 - REG:win.ini: run=??
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: PBlockadeHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\Oemji\Toolbar\PopupBlocker\PBHelper.dll
O3 - Toolbar: Cash2Click.com - {3A72E30A-30F4-40a2-B5D7-0EFB7ED77E68} - C:\Program Files\Internet Explorer\PLUGINS\toolbar72364793.dll
O3 - Toolbar: IE Search Toolbar - {EB381422-F797-4A98-A266-9DC490821907} - C:\Program Files\IESearchToolbar\IESearchToolbar.dll
O3 - Toolbar: Oemji - {804DB5C7-31E6-4885-850A-F1941B58A4C7} - C:\Program Files\Oemji\Toolbar\OemjiSearch.dll
O4 - HKLM\..\Run: [SpySpotter] C:\Program Files\SpySpotter\SpySpotter.exe
O4 - HKLM\..\Run: [bobbypin] C:\Program Files\Easy Erase Spyware Remover\AdBlock.exe
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - HKCU\..\Run: [FSCBoss] C:\Program Files\FSCBoss\FSCBoss.exe
O4 - HKCU\..\Run: [Autoupdate Service] C:\DOCUME~1\BARREL~1\LOCALS~1\Temp\kaka.exe
O4 - Global Startup: Free WebSite Tools.lnk = ?
O9 - Extra button: Cash2Click.com - {6B1EBB20-A98E-47fe-AF8A-77A0DF489828} - C:\Program Files\Internet Explorer\PLUGINS\toolbar72364793.dll
O9 - Extra 'Tools' menuitem: Cash2Click.com - {6B1EBB20-A98E-47fe-AF8A-77A0DF489828} - C:\Program Files\Internet Explorer\PLUGINS\toolbar72364793.dll
If the next line is still in your log after uninstalling OEMJI, do not fix it using HJT. It could break your Internet connection. We will need LSP-Fix to fix this if still present.
O10 - Unknown file in Winsock LSP: c:\program files\oemji\oemjisearchplus\sfbnsp.dll
O16 - DPF: {DC187740-46A9-11D5-A815-00B0D0428C0C} - http://ds1.downloadtech.net/cn1060/pcpowerscan.cab
O16 - DPF: {FC67BB52-AAB6-4282-9D51-2DAFFE73AFD0} - http://download.spyspotter.com/spyspotter/SpSp29952.22opt/SpySpotterInstall.cab

Boot into safe mode and use Windows Explorer to delete:
C:\Program Files\SpySpotter <--- the whole directory
C:\Program Files\Easy Erase Spyware Remover <--- the whole directory
c:\freescan <--- the whole directory
C:\Program Files\IESearchToolbar <--- the whole directory
C:\Documents and Settings\BARREL~1\Local Settings\Temp\kaka.exe

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

 

Wenfri,

You forgot what I requested a few messages back

 

You need to have HJT fix the following line (with no browsers open):
O3 - Toolbar: IE Search Toolbar - {EB381422-F797-4A98-A266-9DC490821907} - C:\Program Files\IESearchToolbar\IESearchToolbar.dll (file missing)

Make sure it is gone! Run another HJT scan and check.

 

Your first log was clean.

In the second log I noticed:
C:\WINDOWS\system32\spider.exe <--- what is this. Were you playing Solitare? If so, that is why we ask to exit all unnecessary programs before scanning. It gives us less to look at and saves time.
C:\Program Files\Internet Explorer\iexplore.exe <---- you MUST remember always shut it down before using HJT

You said Ad-Aware keeps coming up with a major thing! It would be more helpful to tell me what it comes up with.