Spyware problem

This should help:
http://forums.majorgeeks.com/showthread.php?t=38772

Ad-Aware is great, but theres a lot of tools that can remove what it, and other similar tools, can not:

http://forums.majorgeeks.com/showthread.php?t=35407

 

Make sure you have HijackThis version 1.98.2 and it is installed in its own directory. And it is not running from a temp folder or your Desktop. Then post your HijackThis log as a .txt file attachment (not inline text).

 

Why did you have 5 Internet Explorer sessions open when scanning:
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe

Didn't you read our tutorial NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting


It tells you specifically to close all browsers (along with other things).

 

You should look into uninstalling Alset's HelpExpress!

Make sure system restore is disabled and viewing of hidden files is enabled.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.ovncdreyvbhlncfyqsee.com/UHsW2x_CEXCL48SKU5CqpaR_bVb_Iq9AWUG2E2qnoFKhLACYKlmvyCRd0yjOcJec.html
O4 - HKLM\..\Run: [camp kind] C:\PROGRA~1\FRAGBO~1\PURE FLAP PEAK.exe
O4 - HKLM\..\Run: [Openjugsmathfast] C:\Documents and Settings\All Users\Application Data\more grid open jugs\grid active.exe
O4 - HKLM\..\Run: [Microsoft Update] lsass2.exe
O4 - HKLM\..\Run: [Microsoft32.exe] Microsoft32.exe
O4 - HKLM\..\Run: [Send sixth comp tool] C:\Documents and Settings\All Users\Application Data\BarbAceSendSixth\DOGDUMB.exe
O4 - HKLM\..\RunServices: [Microsoft Update] lsass2.exe
O4 - HKLM\..\RunServices: [Microsoft32.exe] Microsoft32.exe
O4 - HKCU\..\Run: [Microsoft Update] lsass2.exe

If you decided to uninstall HelpExpress and this is still present, fix it:
O4 - HKCU\..\Run: [HXIUL.EXE] C:\Program Files\Alset\HelpExpress\Owner\HXIUL.EXE

Do you know what these two lines below are for? If not, you may want to fix them too:
O2 - BHO: (no name) - {ADAE1F96-A206-A204-5469-5FAD0FF30754} - C:\PROGRA~1\MIXLOG~1\PlatformGlue.exe
O2 - BHO: (no name) - {F66DEA30-3FD8-A65C-0250-444BCB269F98} - C:\PROGRA~1\MIXLOG~1\PlatformGlue.exe


Now boot in safe mode and use Windows Explorer to delete:
C:\PROGRA~1\FRAGBO~1 <--- the whole directory, note the real directory name will be a longer name but it begins with FRAGB
C:\Documents and Settings\All Users\Application Data\more grid open jugs <--- the whole directory
C:\Documents and Settings\All Users\Application Data\BarbAceSendSixth <--- the whole directory

lsass2.exe
Microsoft32.exe

You will need to use Advanced search to locate lsass2.exe and Microsoft32.exe. Here's how:


Click Search and the Select "All files and folders"
Enter the filename in the "All or part of the file name:" box, so enter lsass2.exe
Now select "More advanced options"
Make sure the following check boxes are checked:
- Search system folders
- Search hidden files and folders
- Search subfolders

Then click the Search button.
When found, right click on it and select Delete (tell me where you find it). Make sure you only select the one that says exactly lsass2.exe (and Microsoft32.exe).

Do the same for Microsoft32.exe

Now reboot in normal mode and post a new log and tell us how things are working.

 

You're welcome!

You have two minor items in your log that can also be fixed:
O2 - BHO: (no name) - {ADAE1F96-A206-A204-5469-5FAD0FF30754} - (no file)
O2 - BHO: (no name) - {F66DEA30-3FD8-A65C-0250-444BCB269F98} - (no file)