Move hijackthis.exe into a folder, don't run it from your desktop. Make a folder on your hard drive, like c:\hjt.
Download Spybot
http://www.sherrylynn.us/privacypolicy.htm
Make sure to follow the instructions for updates prior to running the scan.
Click on "Search For updates" After the search has completed, the available Updates will be listed. Choose which Updates you would like to Download. Click "Download updates." The Updates will self install. The screen will change and the program will come back and be ready to use.
Sometimes the default Download Location will produce an Error. If that happens, look in the right panel. There you will find a small arrow next to the name of the current Download site. Click on it for a list of alternate sites. One of those should be able to retrieve the files you have selected.
Scan, click on fix problems then reboot.
Next:
Download AdAware
http://www.lavasoftusa.com/support/download/
Before you scan with AdAware, check for updates of the reference file by clicking
on "Check for updates now", connect.
Click on Start, Use custom scanning options, Customize.
Make sure the following settings are made and on -------"ON=GREEN"
"Scan within archives"
"Scan active processes"
"Scan registry"
"Deep scan registry"
"Scan my IE Favorites for banned URL"
"Scan my host-file"
Click on Tweak,
Select scanning engine and click on "Unload recognized processes during scanning"
Select cleaning engine and click on "Automatically try to unregister objects prior to deletion" and "Let windows remove files in use at next reboot"
Then click "proceed" to save your settings.
Click on Next
Run the scan and fix everything.
Reboot.
Run HJT again and check any of these that remain:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://search.ieplugin.com/search.htm
R3 - URLSearchHook: TvmBho Class - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\Program Files\TV Media\TvmBho.dll
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}_ - (no file)
O2 - BHO: (no name) - {00000273-8230-4DD4-BE4F-6889D1E74167} - C:\WINNT\host.dll
O2 - BHO: (no name) - {08351227-6472-43BD-8A40-D9221FF1C4CE} - C:\WINNT\Downloaded Program Files\SbCIe027.dll
O2 - BHO: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\Program Files\TV Media\TvmBho.dll
O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKLM\..\Run: [SysUpd] C:\WINNT\SysUpd.exe
O4 - HKCU\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O16 - DPF: {10000273-8230-4DD4-BE4F-6889D1E74167} -
http://download.abetterinternet.com...B8105/turbo.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) -
http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {AFDBB6D0-6B96-419C-8BC6-FF0B99368C0B} -
http://www.memorymeter.com/MemoryMeter.cab
O16 - DPF: {C72242D0-3AB5-453D-842C-8A3C9AC0838D} -
http://download.sidestep.com/get/k00719/sb027.cab
O16 - DPF: {DCF0768D-BA7A-101A-B57A-0000C0C3ED5F} -
http://203.199.200.61/ads/shareit/da/cab/SysUpd.CAB
O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} (ddm_download.ddm_control) -
http://download.rfwnad.com/cab/crack.CAB
Close all applications and browser windows before you click "fix checked".
Restart in safe mode
Click here to see how
Open My Computer, Go to Tools, Folder Options and click on the View tab. Make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files". Now click "Apply to all folders"
Click "Apply" then "OK"
Delete the following if they remain:
C:\WINNT\SysUpd.exe --> file
C:\WINNT\host.dll --> file
C:\Program Files\TV Media --> folder
Reboot and post another log.
