try this
Click on the link below to download CWshredder
http://www.spywareinfo.com/~merijn/files/cwshredder.zipRun the program and let it do it's thing. Make sure to click on "Fix" and not scan only.
Then run hijack this (http://www.thespykiller.co.uk/)
First thing to do is Make a folder on your hard drive, like c:\hjt and move hijackthis.exe into a folder, don't run it from your temporary internet files.
Run HJT again and check:
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\ljble.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\ljble.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\ljble.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\ljble.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\ljble.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\ljble.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {6EEA0809-1F57-4638-863D-CFEF3545BEEC} - C:\WINDOWS\System32\ljble.dll
Close all applications and browser windows before you click "fix checked".
Include this one if it's not valid.
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL =
http://vip-fld-pxy:8080/fieldceproxy.pacThen:
Restart in safe mode.
Open My Computer. Go to Tools, Folder Options and click on the View tab. Make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files". Now click "Apply to all folders"
Click "Apply" then "OK"
Now using Windows Explorer delete the following.
C:\WINDOWS\System32\ljble.dll --> file
Reboot and post another HJT log.