tetonbob

Was, or is still?

This is symptomatic of a Smtifraud family infection, which is why I had you run that SmitfraudFix Option 1. It didn't find anything, except desktop backgrounds you likely have set yourself. You're not showing any outward signs of this infection any longer.

Part of a complete Smitfraud fix is to do this:

Please navigate to Control Panel. Click on Display>Desktop>Customize Desktop>Website
Under the 'Web pages' box, uncheck and delete everything present.

Next,

Please go to: VirusTotal

• At the top of the page you'll find a "Browse" button. Click the "Browse" button and browse to this file in BOLD:
  
  C:\WINDOWS\SYSTEM32\asprouni.exe
  
  
  
  
• Click "Open".
• Then click the "Send" button at the top of the VirusTotal page.
• This will scan the file. Please be patient.
• Once scanned, copy and paste the results in your next reply together with a new HijackThis log.

Then repeat as above for the following files in BOLD:

C:\WINDOWS\SYSTEM32\wirmczj.dll

---------------------------------------------------------------------------------------------

Create an uninstall list:

• Open HiJackThis
• Click on the button " Open the Misc Tools section"
• Click on the Box that says "Open Uninstall Manager"
• Click on the button "Save list"
• Copy and past the List from the notepad file into your post