You are doing just fine......hang tough.
===========
Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should
not have any open browsers when you are following the procedures below.
This hijack may take a couple of tries to remove it. If you have any questions during this process, please ask us (just don't restart or shutdown - unless the instructions say so).
Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click
Kill process for each one if they are still listed (they shouldn't be - but double check it):
C:\Program Files\NaviSearch\bin\nls.exe
C:\Program Files\CashBack\bin\cashback.exe
C:\Program Files\BullsEye Network\bin\bargains.exe
Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:
NaviSearch
CashBack
BullsEye Network
Delete the following Folders:
C:\Program Files\NaviSearch\
C:\Program Files\CashBack\
C:\Program Files\BullsEye Network\
=============
1. Run CleanUp! program and click on CleanUp button. Say NO when it asks you to reboot/logoff. Check your Downloaded Program Files folder for any program that you do not recognize and remove anything in question.
2. Skip to Step 3
3. Run KillBox now.
a) Click on the 'Delete on Reboot' button.
b) Check 'End Explorer Shell While Killing File.'
c) Check 'Unregister .dll Before Deleting' for each file (if it's available).
Copy and paste each of the following (one by one) into KillBox and hit the X button for each one (when it asks you if you want to reboot, choose NO for all of them):
c:\recycler\desktop.ini
C:\WINDOWS\system32\guard.tmp
C:\WINDOWS\system32\spOrder.dll
C:\WINDOWS\wtqrczkd.exe
C:\WINDOWS\system32\kt00l7dm1.dll
C:\WINDOWS\zeta.exe
4. Restart and hit the F8 key (repeatedly until a menu shows up) to enter Safe Mode.
5. Run HijackThis and do a scan. Check and fix the following:
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [wtqrczkd] C:\WINDOWS\wtqrczkd.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [CashBack] C:\Program Files\CashBack\bin\cashback.exe
O16 - DPF: {0878B424-1F95-4E26-B5AB-F0D349D89650} -
http://download.bargain-buddy.net/d..._MEDIAWHIZ3.cab
O20 - Winlogon Notify: IPConfTSP - C:\WINDOWS\system32\kt00l7dm1.dll
O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe
Close HijackThis and run Hoster. Click 'Restore Original Hosts' and click OK.
Run CleanUp! program again and clean everything. Say Yes when it asks you to reboot/logoff.
6. Reboot into Normal Mode and run HijackThis. See if the O1 entries are still in HijackThis. If they are still there, go to c:\windows\system32\ and sort the files by date. There will/should be two new DLLs.
-- If those O1 entries do return in HijackThis, paste those two files into KillBox (in Step 3 above) and kill them. Just follow through the same procedures (Steps 3 - 6) like before. Make sure NOT to reboot until you deleted those two files (otherwise the names will change again).
After that's done (or if you need more help), give us a new set of updated logs (2 PV logs, 1 notify.txt log, 1 VX2Finder log and 1 HijackThis log).