[Closed] help infected

i cant get rid of the virus even if i press delete the virus when my avira anti virus pops up, i used spybot search and destroy delted the trojans and the malware but still everytime i use google my results i click a link redirects me to some other page that wants me to download something or a advertisement. it will shut down all the internet browsers i try to open immediately after i run the program. mozilla was already running so thats probaly why i can type now but i dont want to turrn off my computer afraid that i cant get onto the internet. also my desktop wall paper settings are locked i cant change it. i am running on windows xp sp3 by the way.


i attatched a dds file and the screen shot of the desktop lock











DDS (Ver_09-12-01.01) - NTFSx86
Run by [removed] at 12:33:01.51 on Mon 12/14/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3070.2075 [GMT -8:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\windows\system32\svchost -k DcomLaunch
svchost.exe
C:\windows\System32\svchost.exe -k netsvcs
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
svchost.exe
svchost.exe
C:\windows\system32\spoolsv.exe
C:\windows\system32\rundll32.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Dualview Server\dualviewsvc.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\windows\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Smart Watchdog\SWDsvc.exe
C:\windows\system32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\windows\Explorer.EXE
C:\windows\RTHDCPL.EXE
C:\windows\system32\rundll32.exe
C:\windows\System32\svchost.exe -k HTTPFilter
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Compal\Wow Video&Audio\WVAMain.exe
C:\Program Files\Compal\Smart Battery\SMBTray.exe
C:\windows\vsnp2uvc.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\windows\system32\rundll32.exe
C:\windows\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
F:\Port. Apps\ClamWinPortable\ClamWinPortable.exe
F:\Port. Apps\ClamWinPortable\App\clamwin\bin\ClamWin.exe
F:\Port. Apps\ClamWinPortable\App\clamwin\bin\clamscan.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\OCZ\Desktop\dds.pif

============== Pseudo HJT Report ===============

uInternet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1033
uInternet Settings,ProxyOverride = local
mWinlogon: Userinit=c:\windows\system32\winlogon86.exe
mWinlogon: UIHost=c:\windows\system32\logonui.exe
BHO: c:\windows\system32\jgttortc8r.dll: {c5b24b16-23f2-41ad-f4e4-00abc39c0004} - c:\windows\system32\jgttortc8r.dll
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Google Update] "c:\documents and settings\ocz\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\Wcescomm.exe"
uRun: [Performance Center] c:\program files\ascentive\performance center\APCMain.exe -m
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [notepad] rundll32.exe c:\docume~1\ocz\ntload.dll,_IWMPEvents@0
uRunOnce: [SpybotDeletingB9935] command.com /c del "c:\windows\system32\28463\TQFD.001"
uRunOnce: [SpybotDeletingD36] cmd.exe /c del "c:\windows\system32\28463\TQFD.001"
uRunOnce: [SpybotDeletingB2558] command.com /c del "c:\documents and settings\ocz\local settings\temp\lsass.exe"
uRunOnce: [SpybotDeletingD4881] cmd.exe /c del "c:\documents and settings\ocz\local settings\temp\lsass.exe"
uRunOnce: [SpybotDeletingB7406] command.com /c del "c:\windows\system32\iassam0.dll"
uRunOnce: [SpybotDeletingD6865] cmd.exe /c del "c:\windows\system32\iassam0.dll"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NVMCTRAY.DLL,NvTaskbarInit
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [SMSERIAL] c:\program files\motorola\smserial\sm56hlpr.exe
mRun: [Wow Video&Audio] c:\program files\compal\wow video&audio\WVAMain.exe
mRun: [Smart Watch Dog] -c:\program files\smart watchdog\SmartWD.exe
mRun: [SMBTray] c:\program files\compal\smart battery\SMBTray.exe
mRun: [LogonStudio] "c:\program files\wincustomize\logonstudio\logonstudio.exe" /RANDOM
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] c:\program files\google\gmail notifier\gnotify.exe
mRun: [snp2uvc] c:\windows\vsnp2uvc.exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [notepad] rundll32.exe c:\windows\system32\notepad.dll,_IWMPEvents@0
mRun: [iinjug] RUNDLL32.EXE c:\windows\system32\msilojzb.dll,w
mRun: [vojoyidoz] Rundll32.exe "c:\windows\system32\nizusatu.dll",a
mRunOnce: [SpybotDeletingA1782] command.com /c del "c:\windows\system32\28463\TQFD.001"
mRunOnce: [SpybotDeletingC4401] cmd.exe /c del "c:\windows\system32\28463\TQFD.001"
mRunOnce: [SpybotDeletingA4380] command.com /c del "c:\documents and settings\ocz\local settings\temp\lsass.exe"
mRunOnce: [SpybotDeletingC517] cmd.exe /c del "c:\documents and settings\ocz\local settings\temp\lsass.exe"
mRunOnce: [SpybotDeletingA7088] command.com /c del "c:\windows\system32\iassam0.dll"
mRunOnce: [SpybotDeletingC5995] cmd.exe /c del "c:\windows\system32\iassam0.dll"
dRun: [notepad] rundll32.exe c:\docume~1\locals~1\ntload.dll,_IWMPEvents@0
StartupFolder: c:\docume~1\ocz\startm~1\programs\startup\gmailn~1.lnk - c:\program files\gmail notifier gpl\notifier.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
uPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: EnableLUA = 0 (0x0)
dPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Save YouTube Video - c:\program files\common files\dvdvideosoft\dll\IEContextMenuY.dll/scriptY2MP4.htm
IE: Save YouTube Video as MP3 - c:\program files\common files\dvdvideosoft\dll\IEContextMenuY.dll/scriptY2MP3.htm
IE: Send to &Bluetooth Device… - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll
IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {D4003189-95B1-4A2F-9A87-F2B03665960D} - hxxp://www.vexcast.com/download/vexcast.cab
TCP: {696A0468-C69D-4644-9FC2-E093EB717072} = 193.104.110.38,4.2.2.1
TCP: {FDAEF667-490B-435C-9EE2-EE1CE7EE1EC2} = 193.104.110.38,4.2.2.1,192.168.0.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
AppInit_DLLs: c:\progra~1\google\google~1\goec62~1.dll piwifene.dll c:\windows\system32\nizusatu.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SSODL: dubogitew - {5c84991f-c819-4c8e-87a9-6fea4000aca2} - c:\windows\system32\nizusatu.dll
STS: c:\windows\system32\jgttortc8r.dll: {c5b24b16-23f2-41ad-f4e4-00abc39c0004} - c:\windows\system32\jgttortc8r.dll
STS: kupuhivus: {5c84991f-c819-4c8e-87a9-6fea4000aca2} - c:\windows\system32\nizusatu.dll
LSA: Notification Packages = scecli jolojizu.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\ocz\applic~1\mozilla\firefox\profiles\wspvgg7t.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, falsec:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============


=============== Created Last 30 ================


==================== Find3M ====================

2007-03-09 07:12:32 27648 –sha-w- c:\windows\system32\AVSredirect.dll
2009-09-14 18:52:32 39424 –sha-w- c:\windows\system32\ganemefa.dll
2009-09-14 18:47:18 52736 –sha-w- c:\windows\system32\jolojizu.dll
2009-09-14 18:52:32 45568 –sha-w- c:\windows\system32\lohohotu.dll
2009-03-21 14:06:58 29696 –sha-w- c:\windows\system32\notepad.dll
2009-09-14 18:47:18 52736 –sha-w- c:\windows\system32\piwifene.dll
2009-09-14 18:47:18 52736 –sha-w- c:\windows\system32\rikozibo.dll

============= FINISH: 12:35:29.18 ===============