Can you please do the following.



===============

Go to Add/Remove programs and uninstall the following, if present:

Web Rebates

The above could appear anywhere within the entry. Be careful not to remove any personal or system software.

===============

Scan with HijackThis and then place a check next to all the following, if present:


O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [Windows SyncroAd] C:\Program Files\Windows SyncroAd\SyncroAd.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [SurfAnonymous] C:\Program Files\SurfAnonymous\SurfAnonymous.exe -1
O4 - HKLM\..\Run: [msbb] c:\temp\msbb.exe
O4 - HKCU\..\Run: [JewelQuestSetup.exe] C:\DOWNLO~1\JEWELQ~1.EXE /r

O11 - Options group: [INTERNATIONAL] International*


Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".

===============

Locate and delete the following item(s), if present. Make sure you are able to view system and hidden files/ folders:

folders...

C:\Program Files\Windows SyncroAd
C:\Program Files\Web_Rebates
C:\Program Files\SurfAnonymous

files...

c:\temp\msbb.exe
C:\DOWNLO~1\JEWELQ~1.EXE

-

Note that some of these file(s)/folder(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them in Safe Mode by doing the following:
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  • Instead of Windows loading as normal, a menu should appear.
Select the first option to run Windows in Safe Mode hit enter.

-

Reboot.

===============

Please go to Jotti's or to virustotal and have this file scanned. Post the results back here.

etkiaheclc.exe

Post back the entire, exact path to the file if it comes back bad.

=======

Once you have done the above, you can go back into msconfig and set it up as you wish again.