jos, please check this file:
Using Windows Explorer (right click on Start> Explore> Windows System 32>
right click on
ActiveToolBand.dll> Properties> check the size of the file and the company:
Is it 292 kb, company HiTRUST
or is it 28 kb with no compaqny information?
This will determine whether the file is legitimate.
I'm not seeing any evidence of about:blank in HJT, but we ask that you follow the steps in the Virus and Malware Removal thread
HERE.
Before you run the scans, please disable these Real Time Protection programs as they can interfer with the scans:
Ad-Aware AE Ad-Watch Live!
- Right click on the Ad-Aware icon in the system tray.
- Click on Disable Ad-Watch Live!
- (Once you are clean, you can re-enable Ad-Watch Live! by clicking on Enable Ad-Watch Live!.)
Spybot Search & Destroy TeaTimer
- Launch Spybot Search & Destroy
- In the Menu, Select Mode and choose Advanced Mode
- Click Yes in the confirmation dialogue box
- click on Tools to expand the menu. Make sure that Resident is checked and then click Resident in the left pane.
- In the right pane uncheck Resident "Tea timer" (Protection of over-all system settings) to disable it.
- Uncheck the TeaTimer box and OK any prompts.
- If Teatimer gives you a warning that changes were made, click the "Allow Change" box when prompted.
- Exit Spybot S&D when done.
- (Once you are clean, you can re-enable Teatimer using the same steps but this time place a check next to "Resident TeaTimer" and check the "TeaTimer" box in System Startup.]
Then run Malwarebytes and Superantispyware.
Attach those logs to your next reply.
Rescan with HijackThis aand
paste in that log in your next reply.
