C Drive

[Malware Removal Specialist]

Download Hoster (do not run it yet)

Please also download ATF Cleaner by Atribune. ATF Cleaner.exe This program does not require an installation. The executable actually runs the program. (do not run it yet)

--------------------

Please copy this page to Notepad and save it to your desktop. (or print it out)
You will be in safe mode and not able to see this page to finish the instructions.

--------------------

Next, please reboot your computer in Safe Mode by doing the following:

1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Use the up arrow key to highlight Safe Mode and press Enter.

--------------------

Open HijackThis then select Do a system scan only and place a check mark next to:

O1 - Hosts: 207.68.176.250 auto.search.msn.com
O1 - Hosts: 66.98.136.25 auto.search.msn.es
O1 - Hosts: 207.68.176.250 auto.search.msn.com
O1 - Hosts: 66.98.136.25 auto.search.msn.es
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (file missing)
O15 - Trusted Zone: *.doginhispen.com
O15 - Trusted Zone: *.whataboutadog.com
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4056/ftp.coupons.com/r3302/Coupons.cab

Now click on Fix checked then exit HijackThis

--------------------

Run Hoster.exe

Click Make Hosts Writable? in the upper right corner (If available).
Click Restore Original Hosts and then click OK.
Click the X to exit the program.

--------------------

Run ATF Cleaner

NOTE: ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.
* Double-click ATF-Cleaner.exe to run the program.
* Under Main choose: Select All
* Click the Empty Selected button.

If you use Firefox browser
* Click Firefox at the top and choose: Select All
* Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser
* Click Opera at the top and choose: Select All
* Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.

--------------------

Reboot to Normal Mode

--------------------

Please download FindAWF:
http://noahdfear.net/downloads/FindAWF.exe

Save the file to the Desktop
Double-click the FindAWF icon.

If a Security Alert shows, allow the program to run.
As instructed, press any key to continue.
Use the following option: Press 1 then Enter to scan for bak folders
The scan may take a while, please be patient.

When done, a text file, Find AWF report is produced.
Please attach the Find AWF report in your reply.

--------------------

Next post please attach
Find AWF report
A NEW HijackThis log