Need help fast

Wow, this absolutely sucks. Task manager doesn't work via CTRL+ALT+DEL. My computer is horribly slow. Popups constantly. System32 errors. New programs being downloaded constantly. I ran spybot and ad aware to remove a bunch of stuff. It is a little better now, but I still have major problems.

I just ran the following Highjack this report. Can someone please help me figure this out? Thanks.


Logfile of HijackThis v1.99.1
Scan saved at 3:42:58 PM, on 8/6/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\TmF0aGFuIEhhcnNo\command.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Network Monitor\netmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\WINDOWS\pgsbivf.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\per.exe
C:\WINDOWS\thiselt.exe
C:\Program Files\spywarebot\SpywareBot.exe
C:\WINDOWS\CCZoop05.exe
C:\WINDOWS\ms062918104137.exe
C:\dfndrfg_8.exe
C:\WINDOWS\pop06ap2.exe
C:\kybrdfg_8.exe
C:\Program Files\Internet Optimizer\optimize.exe
C:\WINDOWS\sys024137291810.exe
C:\nwnmfg_8.exe
C:\WINDOWS\System32\ekuxpv3.exe
C:\WINDOWS\System32\riwzkn.exe
C:\WINDOWS\pgsbivfA.exe
C:\WINDOWS\ms057291810413.exe
C:\Program Files\Common Files\{3E1216F6-0382-1033-0731-000412000001}\Update.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\TBONBin\tbon.exe
C:\WINDOWS\System32\uvzgi.exe
C:\WINDOWS\System32\hauc.exe
C:\PROGRA~1\COMMON~1\riwz\riwzm.exe
C:\Program Files\System Files\System.exe
C:\stub_113_4_0_4_0newer.exe
C:\WINDOWS\System32\zkdmg.exe
C:\Palm\Hotsync.exe
C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
C:\WINDOWS\System32\devldr32.exe
C:\PROGRA~1\COMMON~1\riwz\riwza.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Documents and Settings\Nathan Harsh\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.de/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.de/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mrfindalot.com/search.asp?si=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.mrfindalot.com/search.asp?si=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by Cox High Speed Internet
R3 - URLSearchHook: (no name) - _{199C0C59-11BB-6380-02A2-1675BEA803F2} - (no file)
F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.altavista.com"); (C:\Program Files\Netscape\Users\nharsh23\prefs.js)
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem220.dll
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\System32\pmnkj.dll
O2 - BHO: Wfpmj Class - {A5AD8FF3-64A3-4A07-BE7E-A7E6C197DF73} - C:\WINDOWS\System32\vm7cmapox.dll
O2 - BHO: (no name) - {E5E2A3E7-00FE-4D31-A030-A10799DDCA66} - (no file)
O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\Program Files\NetZero\Toolbar.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\{608ABE96-E32C-47E4-B460-7E04D3530F5E}.dll
O3 - Toolbar: (no name) - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - (no file)
O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\System32\PRISMSVR.EXE" /APPLY
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ControlPanel] C:\WINDOWS\System32\per.exe internat.dll,LoadKeyboardProfile
O4 - HKLM\..\Run: [loaddr] C:\wghol.exe
O4 - HKLM\..\Run: [pop06apelt] C:\WINDOWS\thiselt.exe
O4 - HKLM\..\Run: [barint] NukeSpan.exe
O4 - HKLM\..\Run: [Preliminary] backorif.exe
O4 - HKLM\..\Run: [spywarebot] C:\Program Files\spywarebot\SpywareBot.exe -boot
O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\CCZoop05.exe
O4 - HKLM\..\Run: [ms062918104137] C:\WINDOWS\ms062918104137.exe
O4 - HKLM\..\Run: [defender] C:\\dfndrfg_8.exe
O4 - HKLM\..\Run: [pop06ap] C:\WINDOWS\pop06ap2.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdfg_8.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [ms043729181041] C:\WINDOWS\ms043729181041.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [adstart] "iexplore.exe" "-embedding http://iesettingsupdate"
O4 - HKLM\..\Run: [sys024137291810] C:\WINDOWS\sys024137291810.exe
O4 - HKLM\..\Run: [newname] C:\\nwnmfg_8.exe
O4 - HKLM\..\Run: [zbXb] C:\WINDOWS\System32\ekuxpv3.exe
O4 - HKLM\..\Run: [Nm6NqZ] "C:\WINDOWS\System32\riwzkn.exe"
O4 - HKLM\..\Run: [pgsbivfA] C:\WINDOWS\pgsbivfA.exe
O4 - HKLM\..\Run: [ms057291810413] C:\WINDOWS\ms057291810413.exe
O4 - HKLM\..\Run: [dmnnc.exe] C:\WINDOWS\System32\dmnnc.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [tbon] C:\Program Files\TBONBin\tbon.exe /r
O4 - HKCU\..\Run: [shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [KillAndClean] "C:\Program Files\KillAndClean\KillAndClean.exe"
O4 - HKCU\..\Run: [riwz] C:\PROGRA~1\COMMON~1\riwz\riwzm.exe
O4 - HKCU\..\Run: [CAS2] "C:\Program Files\System Files\System.exe"
O4 - HKCU\..\Run: [clamav] ParisM.exe
O4 - HKCU\..\Run: [zxc] EXE32EXE.exe
O4 - HKCU\..\Run: [progmen] 10010.exe
O4 - HKCU\..\Run: [zwir] C:\stub_113_4_0_4_0newer.exe
O4 - Global Startup: PowerReg Scheduler.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\Hotsync.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar3.dll/cmtrans.html
O9 - Extra button: (no name) - {06FE5D02-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL - {06FE5D02-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra button: (no name) - {06FE5D03-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host - {06FE5D03-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra button: (no name) - {06FE5D04-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
O9 - Extra 'Tools' menuitem: AV Home - {06FE5D04-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
O9 - Extra button: Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra 'Tools' menuitem: AV &Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet6_38.dll' missing
O15 - Trusted Zone: *.adgate.info
O15 - Trusted Zone: *.adsextend.net
O15 - Trusted Zone: *.dollarrevenue.com
O15 - Trusted Zone: *.elitemediagroup.net
O15 - Trusted Zone: *.errorsafe.com
O15 - Trusted Zone: *.matcash.com
O15 - Trusted Zone: *.media-motor.com
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.mediatickets.net
O15 - Trusted Zone: *.mmohsix.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.snipernet.biz
O15 - Trusted Zone: *.systemdoctor.com
O15 - Trusted Zone: *.winantivirus.com
O15 - Trusted Zone: *.winfixer.com
O15 - Trusted Zone: http://click.getmirar.com (HKLM)
O15 - Trusted Zone: http://click.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM)
O16 - DPF: APEX Weight Center 2.0.2.818 - https://application.bodybugg.com/files/stat…x_2_0_2_818.cab
O16 - DPF: APEX Weight Center 2.0.4.822 - https://application.bodybugg.com/files/stat…x_2_0_4_822.cab
O16 - DPF: APEX Weight Center 2.2.0.884 - http://beta.bodybugg.com/files/static/inst…x_2_2_0_884.cab
O16 - DPF: Dialpad Java Applet - http://www.dialpad.com/applet/src/vscp.cab
O16 - DPF: Dialpad US Java Applet - http://www.dialpad.com/applet/src/vscp.cab
O16 - DPF: {044D845A-9314-40A9-8103-77261280B53F} - http://85.255.114.166/1/rdgUS2511.exe
O16 - DPF: {0FC817C2-3B45-11D4-8340-0050DA825907} - http://www.deltaclick.com/bluetree.cab
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.drivecleaner.com/.freeware/inst…leanerstart.cab
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://locator1.cdn.imagesrvr.com/sites/wi…nnerInstall.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{09D61B6E-B486-4862-B92D-D8248B2E778E}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{0D7E5E62-F1A7-465A-AEFB-7F8B6CEE72EB}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{15C08599-C528-4144-A068-FCE6DF1906F3}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{1D4ECF60-0DAA-449B-BB24-C0E6E57FE989}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{7C5811A6-350E-4742-97E2-7264544C0957}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{AD5BDDA1-891A-486D-869F-9736A0A461B5}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{BAA9335A-BD68-4741-AD68-3213F6880D03}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{EBBB9101-4910-4DBE-AB36-1DFB038486E7}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.52 85.255.112.106
O17 - HKLM\System\CS1\Services\Tcpip\..\{09D61B6E-B486-4862-B92D-D8248B2E778E}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.52 85.255.112.106
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter: text/html - {9925D813-EAAC-44AA-BBA7-02DD66D3C6FE} - C:\WINDOWS\System32\vm7cmapox.dll
O20 - Winlogon Notify: APPPATHS - C:\WINDOWS\system32\mTcrovsn.dll
O20 - Winlogon Notify: pmnkj - C:\WINDOWS\SYSTEM32\pmnkj.dll
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\TmF0aGFuIEhhcnNo\command.exe
O23 - Service: DvpApi (dvpapi) - Unknown owner - C:\Program Files\Common Files\Command Software\dvpapi.exe (file missing)
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\pgsbivf.exe

Thanks for offering to help me. I have about given up on this beast! Here is my most recent Hijack This log:

Logfile of HijackThis v1.99.1
Scan saved at 7:13:31 AM, on 8/19/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
C:\Program Files\Cyberhawk\CHService.exe
C:\Program Files\Ewido Anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Cyberhawk\CHTray.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Ewido Anti-spyware 4.0\ewido.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\MalwareSweeper.com\MalwareSweeper\MalSwep.exe
C:\Palm\Hotsync.exe
C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
C:\Documents and Settings\Nathan Harsh\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.180nutrition.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by Cox High Speed Internet
R3 - URLSearchHook: (no name) - _{199C0C59-11BB-6380-02A2-1675BEA803F2} - (no file)
F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Program Files\Netscape\Users\nharsh23\prefs.js)
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\pmnkj.dll
O2 - BHO: Wfpmj Class - {A5AD8FF3-64A3-4A07-BE7E-A7E6C197DF73} - C:\WINDOWS\System32\vm7cmapox.dll
O2 - BHO: (no name) - {E5E2A3E7-00FE-4D31-A030-A10799DDCA66} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\System32\PRISMSVR.EXE" /APPLY
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [loaddr] C:\wghol.exe
O4 - HKLM\..\Run: [ms043729181041] C:\WINDOWS\ms043729181041.exe
O4 - HKLM\..\Run: [Cyberhawk] C:\Program Files\Cyberhawk\CHTray.exe
O4 - HKLM\..\Run: [spywarebot] "C:\Program Files\spywarebot\spywarebot.exe" -boot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\Ewido Anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [dmypz.exe] C:\WINDOWS\System32\dmypz.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [tbon] C:\Program Files\TBONBin\tbon.exe /r
O4 - HKCU\..\Run: [shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
O4 - HKCU\..\Run: [KillAndClean] "C:\Program Files\KillAndClean\KillAndClean.exe"
O4 - HKCU\..\Run: [riwz] C:\PROGRA~1\COMMON~1\riwz\riwzm.exe
O4 - HKCU\..\Run: [CAS2] "C:\Program Files\System Files\System.exe"
O4 - HKCU\..\Run: [clamav] ParisM.exe
O4 - HKCU\..\Run: [zxc] EXE32EXE.exe
O4 - HKCU\..\Run: [progmen] 10010.exe
O4 - HKCU\..\Run: [Malware Sweeper] C:\Program Files\MalwareSweeper.com\MalwareSweeper\MalSwep.exe /STARTUP
O4 - Global Startup: PowerReg Scheduler.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\Hotsync.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar3.dll/cmtrans.html
O9 - Extra button: (no name) - {06FE5D02-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL - {06FE5D02-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra button: (no name) - {06FE5D03-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host - {06FE5D03-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra button: (no name) - {06FE5D04-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
O9 - Extra 'Tools' menuitem: AV Home - {06FE5D04-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
O9 - Extra button: Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra 'Tools' menuitem: AV &Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet6_38.dll' missing
O15 - Trusted Zone: *.elitemediagroup.net
O15 - Trusted Zone: *.errorsafe.com
O15 - Trusted Zone: *.matcash.com
O15 - Trusted Zone: *.media-motor.com
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.mediatickets.net
O15 - Trusted Zone: *.mmohsix.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.snipernet.biz
O15 - Trusted Zone: *.systemdoctor.com
O15 - Trusted Zone: *.winantivirus.com
O15 - Trusted Zone: *.winfixer.com
O16 - DPF: APEX Weight Center 2.0.2.818 - https://application.bodybugg.com/files/stat…x_2_0_2_818.cab
O16 - DPF: APEX Weight Center 2.0.4.822 - https://application.bodybugg.com/files/stat…x_2_0_4_822.cab
O16 - DPF: APEX Weight Center 2.2.0.884 - http://beta.bodybugg.com/files/static/inst…x_2_2_0_884.cab
O16 - DPF: Dialpad Java Applet - http://www.dialpad.com/applet/src/vscp.cab
O16 - DPF: Dialpad US Java Applet - http://www.dialpad.com/applet/src/vscp.cab
O16 - DPF: {044D845A-9314-40A9-8103-77261280B53F} - http://85.255.114.166/1/rdgUS2511.exe
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{09D61B6E-B486-4862-B92D-D8248B2E778E}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{0D7E5E62-F1A7-465A-AEFB-7F8B6CEE72EB}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{15C08599-C528-4144-A068-FCE6DF1906F3}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{1D4ECF60-0DAA-449B-BB24-C0E6E57FE989}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{7C5811A6-350E-4742-97E2-7264544C0957}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{AD5BDDA1-891A-486D-869F-9736A0A461B5}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{BAA9335A-BD68-4741-AD68-3213F6880D03}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{EBBB9101-4910-4DBE-AB36-1DFB038486E7}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.52 85.255.112.106
O17 - HKLM\System\CS1\Services\Tcpip\..\{09D61B6E-B486-4862-B92D-D8248B2E778E}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.52 85.255.112.106
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter: text/html - {9925D813-EAAC-44AA-BBA7-02DD66D3C6FE} - C:\WINDOWS\System32\vm7cmapox.dll
O20 - Winlogon Notify: ExtShellViews - C:\WINDOWS\system32\r66ulgj916o.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\TmF0aGFuIEhhcnNo\command.exe (file missing)
O23 - Service: Cyberhawk - Novatix Corporation - C:\Program Files\Cyberhawk\CHService.exe
O23 - Service: DvpApi (dvpapi) - Unknown owner - C:\Program Files\Common Files\Command Software\dvpapi.exe (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\Ewido Anti-spyware 4.0\guard.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\pgsbivf.exe (file missing)

Thanks again for your assistance.

Hijackthis needs to be in its own folder:

a.) While in your desktop, Right click in the background > Go to new > Click folder > Name the folder HJT

b.) After creating the folder, find your Hijackthis.exe (it looks like a detonator with some dynamites). Then drag and drop that file to the new folder you created.
==========================
Go to control panel > add/remove programs > Uninstall the items in bold if found.

SpywareBot
KillandClean
Both of those are considered as Rogue Antispyware Applications as listed HERE

Reboot
==========================
Download CCleaner
http://www.ccleaner.com/ccdownload.asp

Install it and allow it to check for updates.
DO NOT USE IT YET
==========================
Please download Brute Force Uninstaller.
Unzip it to it’s own folder (c:\BFU)

RIGHT-CLICK HERE and choose "Save As" (in IE it's "Save Target As") in order to download Alcra Remover.

Save it in the folder you made earlier (c:\BFU).
DO NOT USE IT YET
==========================
Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.
• Please post the contents of C:\vundofix.txt and a new HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
==========================
Open notepad. It must be notepad, not wordpad.
Copy and paste the text inside the code box below into notepad
Choose file save as and set file type to all files.
Type delservices.bat in the file name and save it to your desktop.

@echo off
sc stop cmdService
sc delete cmdService
sc stop "Windows Overlay Components"
sc delete "Windows Overlay Components"

DO NOT USE IT YET
==========================
Open hijackthis > choose scan only > tick the boxes beside these entries in bold

R3 - URLSearchHook: (no name) - _{199C0C59-11BB-6380-02A2-1675BEA803F2} - (no file)
F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\pmnkj.dll
O2 - BHO: Wfpmj Class - {A5AD8FF3-64A3-4A07-BE7E-A7E6C197DF73} - C:\WINDOWS\System32\vm7cmapox.dll
O2 - BHO: (no name) - {E5E2A3E7-00FE-4D31-A030-A10799DDCA66} - (no file)
O4 - HKLM\..\Run: [loaddr] C:\wghol.exe
O4 - HKLM\..\Run: [ms043729181041] C:\WINDOWS\ms043729181041.exe
O4 - HKLM\..\Run: [spywarebot] "C:\Program Files\spywarebot\spywarebot.exe" -boot
O4 - HKLM\..\Run: [dmypz.exe] C:\WINDOWS\System32\dmypz.exe
O4 - HKCU\..\Run: [shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
O4 - HKCU\..\Run: [KillAndClean] "C:\Program Files\KillAndClean\KillAndClean.exe"
O4 - HKCU\..\Run: [riwz] C:\PROGRA~1\COMMON~1\riwz\riwzm.exe
O4 - HKCU\..\Run: [CAS2] "C:\Program Files\System Files\System.exe"
O4 - HKCU\..\Run: [clamav] ParisM.exe
O4 - HKCU\..\Run: [zxc] EXE32EXE.exe
O4 - HKCU\..\Run: [progmen] 10010.exe
O9 - Extra button: (no name) - {06FE5D02-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL - {06FE5D02-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra button: (no name) - {06FE5D03-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host - {06FE5D03-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra button: Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra 'Tools' menuitem: AV &Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O15 - Trusted Zone: *.elitemediagroup.net
O15 - Trusted Zone: *.errorsafe.com
O15 - Trusted Zone: *.matcash.com
O15 - Trusted Zone: *.media-motor.com
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.mediatickets.net
O15 - Trusted Zone: *.mmohsix.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.snipernet.biz
O15 - Trusted Zone: *.systemdoctor.com
O15 - Trusted Zone: *.winantivirus.com
O15 - Trusted Zone: *.winfixer.com
O16 - DPF: {044D845A-9314-40A9-8103-77261280B53F} - http://85.255.114.166/1/rdgUS2511.exe
O18 - Filter: text/html - {9925D813-EAAC-44AA-BBA7-02DD66D3C6FE} - C:\WINDOWS\System32\vm7cmapox.dll
O20 - Winlogon Notify: ExtShellViews - C:\WINDOWS\system32\r66ulgj916o.dll (file missing)

close ALL browsers and windows/programs that are running, leave only hijackthis running then click "Fix Checked"
==========================
Reboot into Safe Mode

You may want to print these instructions here or save them in notepad since you'll work offline

To enter Safe Mode

Click start > turn off computer > Restart > When you hear the computer beep once, begin tapping F8 rapidly > this will bring up a menu > use your keyboard to scroll to safe mode > hit enter

If you need further instructions/help on how to go to safe mode, see THIS
==========================
Locate delservices.bat on your Desktop and double-click on it.
==========================
You may need to see your hidden files first

Windows XP

* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files option.
* Click Yes to confirm.
* Click OK.

You can refer to this site HERE
==========================
Open Windows Explorer by hitting your windows key + E at the same time.
*If you do not have a windows key, double click my computer > click the folders icon

Then navigate to these files and delete them:

C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe
C:\C:\wghol.exe
C:\WINDOWS\ms043729181041.exe
C:\WINDOWS\pgsbivf.exe
C:\WINDOWS\System32\vm7cmapox.dll
C:\WINDOWS\System32\dmypz.exe

Using the window's search feature, search for these files and delete all instances found:
ParisM.exe
EXE32EXE.exe
10010.exe
rdgUS2511.exe


Then navigate to these folders and delete them:

C:\Program Files\System Files
C:\Program Files\KillAndClean
C:\Program Files\spywarebot
C:\Program Files\Common Files\riwz
C:\WINDOWS\TmF0aGFuIEhhcnNo
Empty your recycle bin
==========================
Run CCleaner

• Click the Advanced tab
• Uncheck: Only delete files older than 48 hrs
• click OK
• Then click Run Cleaner (bottom right) then Exit

==========================
Open My Computer and navigate to the c:\BFU folder.

Start the Brute Force Uninstaller by doubleclicking BFU.exe
In the 'Scriptline to execute' field, copy and paste:

c:\bfu\alcanshorty.bfu
Press execute and let it do it’s job.
Wait for the complete script execution box to pop up and press OK.
Press exit to terminate the BFU program.
==========================
Close ALL open Windows / Programs / Folders. Please start Ewido and run a full scan.

• Click on Scanner
• Click on the Settings tab.
  • Under How to act?
    Click on Recommended Action and choose Quarantine from the popup menu.
  • Under How to scan?
    All checkboxes should be ticked.
  • Under Possibly unwanted software:
    All checkboxes should be ticked.
  • Under Reports:
    Select Automatically generate report after every scan and uncheck Only if threats were found.
  • Under What to scan?
    Select Scan every file.
• Click on the Scan tab.
• Click on Complete System Scan to start the scan process.
• Let the program scan the machine.
• When the scan has finished:
  • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
  • At the bottom of the window click on the Apply all Actions button. (3)
• When done, click the Save Scan Report button.
  • Click the Save Report as button.
  • Save the report to your Desktop.
• Right-click the Ewido Tray Icon and select Exit. Confirm by clicking Yes.

Reboot in Normal Mode.
==========================
On your next reply, please include:

• A Fresh Hijackthis log
• Ewido log
• A detailed description on how your computer is behaving

Hi, please reboot and rerun vundofix again..

Also, I have edited my post please make sure you run throught it again so you won't miss the changes

Hijackthis needs to be in its own folder:

a.) While in your desktop, Right click in the background > Go to new > Click folder > Name the folder HJT

b.) After creating the folder, find your Hijackthis.exe (it looks like a detonator with some dynamites). Then drag and drop that file to the new folder you created.
==========================
Pls. download LSP FIX from Here
*In the event that you lose connection after removing NewDotNet, just run the tool then click "Finish" and it will restore your internet connection.
Do not mess with this tool or do anything with it besides the instructions above
==========================
Go to control panel > add/remove programs > Uninstall the items in bold if found.

SpywareBot
KillandClean
Both of those are considered as Rogue Antispyware Applications as listed HERE
NewdotNet or New.Net <

If you didn't find NewDotNet in the add/remove list, pls go Here and proceed to procedure #4 and download the uninstaller there then run it.

Reboot
==========================
Download CCleaner
http://www.ccleaner.com/ccdownload.asp

Install it and allow it to check for updates.
DO NOT USE IT YET
==========================
Please download Brute Force Uninstaller.
Unzip it to it’s own folder (c:\BFU)

RIGHT-CLICK HERE and choose "Save As" (in IE it's "Save Target As") in order to download Alcra Remover.

Save it in the folder you made earlier (c:\BFU).
DO NOT USE IT YET
==========================
Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.
• Please post the contents of C:\vundofix.txt and a new HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.
==========================
Open notepad. It must be notepad, not wordpad.
Copy and paste the text inside the code box below into notepad
Choose file save as and set file type to all files.
Type delservices.bat in the file name and save it to your desktop.

@echo off
sc stop cmdService
sc delete cmdService
sc stop "Windows Overlay Components"
sc delete "Windows Overlay Components"

DO NOT USE IT YET
==========================
Open hijackthis > choose scan only > tick the boxes beside these entries in bold

R3 - URLSearchHook: (no name) - _{199C0C59-11BB-6380-02A2-1675BEA803F2} - (no file)
F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\pmnkj.dll
O2 - BHO: Wfpmj Class - {A5AD8FF3-64A3-4A07-BE7E-A7E6C197DF73} - C:\WINDOWS\System32\vm7cmapox.dll
O2 - BHO: (no name) - {E5E2A3E7-00FE-4D31-A030-A10799DDCA66} - (no file)
O4 - HKLM\..\Run: [loaddr] C:\wghol.exe
O4 - HKLM\..\Run: [ms043729181041] C:\WINDOWS\ms043729181041.exe
O4 - HKLM\..\Run: [spywarebot] "C:\Program Files\spywarebot\spywarebot.exe" -boot
O4 - HKLM\..\Run: [dmypz.exe] C:\WINDOWS\System32\dmypz.exe
O4 - HKCU\..\Run: [shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
O4 - HKCU\..\Run: [KillAndClean] "C:\Program Files\KillAndClean\KillAndClean.exe"
O4 - HKCU\..\Run: [riwz] C:\PROGRA~1\COMMON~1\riwz\riwzm.exe
O4 - HKCU\..\Run: [CAS2] "C:\Program Files\System Files\System.exe"
O4 - HKCU\..\Run: [clamav] ParisM.exe
O4 - HKCU\..\Run: [zxc] EXE32EXE.exe
O4 - HKCU\..\Run: [progmen] 10010.exe
O9 - Extra button: (no name) - {06FE5D02-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL - {06FE5D02-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra button: (no name) - {06FE5D03-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host - {06FE5D03-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra button: Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra 'Tools' menuitem: AV &Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O15 - Trusted Zone: *.elitemediagroup.net
O15 - Trusted Zone: *.errorsafe.com
O15 - Trusted Zone: *.matcash.com
O15 - Trusted Zone: *.media-motor.com
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.mediatickets.net
O15 - Trusted Zone: *.mmohsix.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.snipernet.biz
O15 - Trusted Zone: *.systemdoctor.com
O15 - Trusted Zone: *.winantivirus.com
O15 - Trusted Zone: *.winfixer.com
O16 - DPF: {044D845A-9314-40A9-8103-77261280B53F} - http://85.255.114.166/1/rdgUS2511.exe
O18 - Filter: text/html - {9925D813-EAAC-44AA-BBA7-02DD66D3C6FE} - C:\WINDOWS\System32\vm7cmapox.dll
O20 - Winlogon Notify: ExtShellViews - C:\WINDOWS\system32\r66ulgj916o.dll (file missing)

close ALL browsers and windows/programs that are running, leave only hijackthis running then click "Fix Checked"
==========================
Reboot into Safe Mode

You may want to print these instructions here or save them in notepad since you'll work offline

To enter Safe Mode

Click start > turn off computer > Restart > When you hear the computer beep once, begin tapping F8 rapidly > this will bring up a menu > use your keyboard to scroll to safe mode > hit enter

If you need further instructions/help on how to go to safe mode, see THIS
==========================
Locate delservices.bat on your Desktop and double-click on it.
==========================
You may need to see your hidden files first

Windows XP

* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files option.
* Click Yes to confirm.
* Click OK.

You can refer to this site HERE
==========================
Open Windows Explorer by hitting your windows key + E at the same time.
*If you do not have a windows key, double click my computer > click the folders icon

Then navigate to these files and delete them:

C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe
C:\wghol.exe
C:\WINDOWS\ms043729181041.exe
C:\WINDOWS\pgsbivf.exe
C:\WINDOWS\System32\vm7cmapox.dll
C:\WINDOWS\System32\dmypz.exe

Using the window's search feature, search for these files and delete all instances found:
ParisM.exe
EXE32EXE.exe
10010.exe
rdgUS2511.exe


Then navigate to these folders and delete them:

C:\Program Files\System Files
C:\Program Files\KillAndClean
C:\Program Files\spywarebot
C:\Program Files\Common Files\riwz
C:\WINDOWS\TmF0aGFuIEhhcnNo
Empty your recycle bin
==========================
Run CCleaner

• Click the Advanced tab
• Uncheck: Only delete files older than 48 hrs
• click OK
• Then click Run Cleaner (bottom right) then Exit

==========================
Open My Computer and navigate to the c:\BFU folder.

Start the Brute Force Uninstaller by doubleclicking BFU.exe
In the 'Scriptline to execute' field, copy and paste:

c:\bfu\alcanshorty.bfu
Press execute and let it do it’s job.
Wait for the complete script execution box to pop up and press OK.
Press exit to terminate the BFU program.
==========================
Close ALL open Windows / Programs / Folders. Please start Ewido and run a full scan.

• Click on Scanner
• Click on the Settings tab.
  • Under How to act?
    Click on Recommended Action and choose Quarantine from the popup menu.
  • Under How to scan?
    All checkboxes should be ticked.
  • Under Possibly unwanted software:
    All checkboxes should be ticked.
  • Under Reports:
    Select Automatically generate report after every scan and uncheck Only if threats were found.
  • Under What to scan?
    Select Scan every file.
• Click on the Scan tab.
• Click on Complete System Scan to start the scan process.
• Let the program scan the machine.
• When the scan has finished:
  • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
  • At the bottom of the window click on the Apply all Actions button. (3)
• When done, click the Save Scan Report button.
  • Click the Save Report as button.
  • Save the report to your Desktop.
• Right-click the Ewido Tray Icon and select Exit. Confirm by clicking Yes.

Reboot in Normal Mode.
==========================
On your next reply, please include:

• A Fresh Hijackthis log
• Ewido log
• A detailed description on how your computer is behaving

So far I have uninstalled SpywareBot and NewdotNet. I couldn't find KillandClean in add/remove programs. I downloaded LSP FIX, CCleaner, and Brute Force Uinstaller. I ran the VundoFix and got rid of pmnkj.dll. I just ran a new HJT. Both the VundoFix and new HJT logs are below.


VundoFix V6.1.0

Checking Java version…

Sun Java not detected
Scan started at 10:47:09 AM 8/20/2006

Listing files found while scanning….

C:\WINDOWS\SYSTEM32\pmnkj.dll

Beginning removal…

Attempting to delete C:\WINDOWS\SYSTEM32\pmnkj.dll
C:\WINDOWS\SYSTEM32\pmnkj.dll Has been deleted!

Performing Repairs to the registry.
Done!
+++++++++++++++++++++++++++++++++++++++++++++

New Hijackthis Log

Logfile of HijackThis v1.99.1
Scan saved at 9:48:46 PM, on 8/21/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
C:\Program Files\Cyberhawk\CHService.exe
C:\Program Files\Ewido Anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Cyberhawk\CHTray.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Ewido Anti-spyware 4.0\ewido.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\Program Files\MalwareSweeper.com\MalwareSweeper\MalSwep.exe
C:\Palm\Hotsync.exe
C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Nathan Harsh\Desktop\HTJ\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.180nutrition.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by Cox High Speed Internet
R3 - URLSearchHook: (no name) - _{199C0C59-11BB-6380-02A2-1675BEA803F2} - (no file)
F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Program Files\Netscape\Users\nharsh23\prefs.js)
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: Wfpmj Class - {A5AD8FF3-64A3-4A07-BE7E-A7E6C197DF73} - C:\WINDOWS\System32\vm7cmapox.dll
O2 - BHO: (no name) - {E5E2A3E7-00FE-4D31-A030-A10799DDCA66} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\System32\PRISMSVR.EXE" /APPLY
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [loaddr] C:\wghol.exe
O4 - HKLM\..\Run: [ms043729181041] C:\WINDOWS\ms043729181041.exe
O4 - HKLM\..\Run: [Cyberhawk] C:\Program Files\Cyberhawk\CHTray.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [dmypz.exe] C:\WINDOWS\System32\dmypz.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [tbon] C:\Program Files\TBONBin\tbon.exe /r
O4 - HKCU\..\Run: [shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
O4 - HKCU\..\Run: [KillAndClean] "C:\Program Files\KillAndClean\KillAndClean.exe"
O4 - HKCU\..\Run: [riwz] C:\PROGRA~1\COMMON~1\riwz\riwzm.exe
O4 - HKCU\..\Run: [CAS2] "C:\Program Files\System Files\System.exe"
O4 - HKCU\..\Run: [clamav] ParisM.exe
O4 - HKCU\..\Run: [zxc] EXE32EXE.exe
O4 - HKCU\..\Run: [progmen] 10010.exe
O4 - HKCU\..\Run: [Malware Sweeper] C:\Program Files\MalwareSweeper.com\MalwareSweeper\MalSwep.exe /STARTUP
O4 - Global Startup: PowerReg Scheduler.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\Hotsync.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar3.dll/cmtrans.html
O9 - Extra button: (no name) - {06FE5D02-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL - {06FE5D02-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra button: (no name) - {06FE5D03-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host - {06FE5D03-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra button: (no name) - {06FE5D04-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
O9 - Extra 'Tools' menuitem: AV Home - {06FE5D04-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
O9 - Extra button: Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra 'Tools' menuitem: AV &Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/redirec…c00&LC=0409 (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet6_38.dll' missing
O15 - Trusted Zone: *.elitemediagroup.net
O15 - Trusted Zone: *.errorsafe.com
O15 - Trusted Zone: *.matcash.com
O15 - Trusted Zone: *.media-motor.com
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.mediatickets.net
O15 - Trusted Zone: *.mmohsix.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.snipernet.biz
O15 - Trusted Zone: *.winfixer.com
O16 - DPF: APEX Weight Center 2.0.2.818 - https://application.bodybugg.com/files/stat…x_2_0_2_818.cab
O16 - DPF: APEX Weight Center 2.0.4.822 - https://application.bodybugg.com/files/stat…x_2_0_4_822.cab
O16 - DPF: APEX Weight Center 2.2.0.884 - http://beta.bodybugg.com/files/static/inst…x_2_2_0_884.cab
O16 - DPF: Dialpad Java Applet - http://www.dialpad.com/applet/src/vscp.cab
O16 - DPF: Dialpad US Java Applet - http://www.dialpad.com/applet/src/vscp.cab
O16 - DPF: {044D845A-9314-40A9-8103-77261280B53F} - http://85.255.114.166/1/rdgUS2511.exe
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{09D61B6E-B486-4862-B92D-D8248B2E778E}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{0D7E5E62-F1A7-465A-AEFB-7F8B6CEE72EB}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{15C08599-C528-4144-A068-FCE6DF1906F3}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{1D4ECF60-0DAA-449B-BB24-C0E6E57FE989}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{7C5811A6-350E-4742-97E2-7264544C0957}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{AD5BDDA1-891A-486D-869F-9736A0A461B5}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{BAA9335A-BD68-4741-AD68-3213F6880D03}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{EBBB9101-4910-4DBE-AB36-1DFB038486E7}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.52 85.255.112.106
O17 - HKLM\System\CS1\Services\Tcpip\..\{09D61B6E-B486-4862-B92D-D8248B2E778E}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.52 85.255.112.106
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter: text/html - {9925D813-EAAC-44AA-BBA7-02DD66D3C6FE} - C:\WINDOWS\System32\vm7cmapox.dll
O20 - Winlogon Notify: ExtShellViews - C:\WINDOWS\system32\r66ulgj916o.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\TmF0aGFuIEhhcnNo\command.exe (file missing)
O23 - Service: Cyberhawk - Novatix Corporation - C:\Program Files\Cyberhawk\CHService.exe
O23 - Service: DvpApi (dvpapi) - Unknown owner - C:\Program Files\Common Files\Command Software\dvpapi.exe (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\Ewido Anti-spyware 4.0\guard.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\pgsbivf.exe (file missing)


My next step is to go through and delete all the files that you told me to with highjackthis. I will do this and the rest of the steps. Wish me luck!! Thanks again.

Sorry about being so slow getting this done. The VundoFix seriously took about 25 hours to complete. Anyways, I have completed everything you gave me to do. I was unable to find and/or delete the following:

KillandClean
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe
C:\wghol.exe
C:\WINDOWS\ms043729181041.exe
C:\WINDOWS\pgsbivf.exe
C:\WINDOWS\System32\vm7cmapox.dll
C:\WINDOWS\System32\dmypz.exe
ParisM.exe
EXE32EXE.exe
10010.exe
rdgUS2511.exe
C:\Program Files\System Files
C:\Program Files\KillAndClean
C:\WINDOWS\TmF0aGFulEhhenNo

I am still having problems with my background not working, Mcafee not working, not being able to delete Kazaa, and my computer running slow.

After I rebooted my computer, I ran Malware Sweeper and it found a Trojan called Hyborate. I removed it, but I don't know if it is actaully gone because I removed it one other time when I first got the scanner.

I also ran AVG Anti-virus scan and it found a virus called Downloader.Obfuskated which has the filename rdgUS2511.exe.


Here is my newest HJT log. It appears that all of the stuff I tried to have HJT fix is still there.

Logfile of HijackThis v1.99.1
Scan saved at 9:11:42 PM, on 8/22/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
C:\Program Files\Cyberhawk\CHService.exe
C:\Program Files\Ewido Anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Cyberhawk\CHTray.exe
C:\Program Files\MalwareSweeper.com\MalwareSweeper\MalSwep.exe
C:\WINDOWS\System32\devldr32.exe
C:\Palm\Hotsync.exe
C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Network Associates\VirusScan\Webscanx.exe
C:\Documents and Settings\Nathan Harsh\Desktop\HTJ\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.180nutrition.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by Cox High Speed Internet
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Program Files\Netscape\Users\nharsh23\prefs.js)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\System32\PRISMSVR.EXE" /APPLY
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Cyberhawk] C:\Program Files\Cyberhawk\CHTray.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [tbon] C:\Program Files\TBONBin\tbon.exe /r
O4 - HKCU\..\Run: [Malware Sweeper] C:\Program Files\MalwareSweeper.com\MalwareSweeper\MalSwep.exe /STARTUP
O4 - Global Startup: PowerReg Scheduler.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\Hotsync.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar3.dll/cmtrans.html
O9 - Extra button: (no name) - {06FE5D04-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
O9 - Extra 'Tools' menuitem: AV Home - {06FE5D04-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet6_38.dll' missing
O16 - DPF: APEX Weight Center 2.0.2.818 - https://application.bodybugg.com/files/stat…x_2_0_2_818.cab
O16 - DPF: APEX Weight Center 2.0.4.822 - https://application.bodybugg.com/files/stat…x_2_0_4_822.cab
O16 - DPF: APEX Weight Center 2.2.0.884 - http://beta.bodybugg.com/files/static/inst…x_2_2_0_884.cab
O16 - DPF: Dialpad Java Applet - http://www.dialpad.com/applet/src/vscp.cab
O16 - DPF: Dialpad US Java Applet - http://www.dialpad.com/applet/src/vscp.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{09D61B6E-B486-4862-B92D-D8248B2E778E}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{0D7E5E62-F1A7-465A-AEFB-7F8B6CEE72EB}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{15C08599-C528-4144-A068-FCE6DF1906F3}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{1D4ECF60-0DAA-449B-BB24-C0E6E57FE989}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{7C5811A6-350E-4742-97E2-7264544C0957}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{AD5BDDA1-891A-486D-869F-9736A0A461B5}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{BAA9335A-BD68-4741-AD68-3213F6880D03}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\..\{EBBB9101-4910-4DBE-AB36-1DFB038486E7}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.52 85.255.112.106
O17 - HKLM\System\CS1\Services\Tcpip\..\{09D61B6E-B486-4862-B92D-D8248B2E778E}: NameServer = 85.255.116.52,85.255.112.106
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.52 85.255.112.106
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
O23 - Service: Cyberhawk - Novatix Corporation - C:\Program Files\Cyberhawk\CHService.exe
O23 - Service: DvpApi (dvpapi) - Unknown owner - C:\Program Files\Common Files\Command Software\dvpapi.exe (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\Ewido Anti-spyware 4.0\guard.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

*****************************************************************************

———————————————————
ewido anti-spyware - Scan Report
———————————————————

+ Created at: 7:27:23 AM 8/22/2006

+ Scan result:



C:\VundoFix Backups\pmnkj.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\WINDOWS\Downloaded Program Files\USDR6_0001_D18M2707NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.l : Cleaned with backup (quarantined).
C:\Program Files\Network Monitor\netmon.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Cleaned with backup (quarantined).


::Report end



Let me know what I need to do next. Thanks.

I did everything that you told me to. I'm not getting rediculous popups while I'm online and the internet seems to be a little faster. However, starting programs is really slow. My background still doesn't work for my desktop. The screen is white and flashes gray every couple seconds. Really annoying. I went to control panel/ display/background and it is shaded and unavailable for me to change. Other than that, Macfee virus scan still not letting me enable it to do a system scan.

Here is my HJT log and FixWareout Report:

Logfile of HijackThis v1.99.1
Scan saved at 11:59:10 PM, on 8/25/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
C:\Program Files\Cyberhawk\CHService.exe
C:\Program Files\Ewido Anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\WINDOWS\System32\devldr32.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Cyberhawk\CHTray.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\MalwareSweeper.com\MalwareSweeper\MalSwep.exe
C:\Palm\Hotsync.exe
C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Network Associates\VirusScan\Webscanx.exe
C:\Documents and Settings\Nathan Harsh\Desktop\HTJ\HJT.exe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by Cox High Speed Internet
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Program Files\Netscape\Users\nharsh23\prefs.js)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\System32\PRISMSVR.EXE" /APPLY
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Cyberhawk] C:\Program Files\Cyberhawk\CHTray.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [tbon] C:\Program Files\TBONBin\tbon.exe /r
O4 - HKCU\..\Run: [Malware Sweeper] C:\Program Files\MalwareSweeper.com\MalwareSweeper\MalSwep.exe /STARTUP
O4 - Global Startup: PowerReg Scheduler.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\Hotsync.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar3.dll/cmtrans.html
O9 - Extra button: (no name) - {06FE5D04-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
O9 - Extra 'Tools' menuitem: AV Home - {06FE5D04-8F11-11d2-804F-00105A133818} - http://jump.altavista.com/avie5/home (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: APEX Weight Center 2.0.2.818 - https://application.bodybugg.com/files/stat…x_2_0_2_818.cab
O16 - DPF: APEX Weight Center 2.0.4.822 - https://application.bodybugg.com/files/stat…x_2_0_4_822.cab
O16 - DPF: APEX Weight Center 2.2.0.884 - http://beta.bodybugg.com/files/static/inst…x_2_2_0_884.cab
O16 - DPF: Dialpad Java Applet - http://www.dialpad.com/applet/src/vscp.cab
O16 - DPF: Dialpad US Java Applet - http://www.dialpad.com/applet/src/vscp.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
O23 - Service: Cyberhawk - Novatix Corporation - C:\Program Files\Cyberhawk\CHService.exe
O23 - Service: DvpApi (dvpapi) - Unknown owner - C:\Program Files\Common Files\Command Software\dvpapi.exe (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\Ewido Anti-spyware 4.0\guard.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

****************************************************************************


Fixwareout ver 1.003
Last edited 8/11/2006
Post this report in the forums please

Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\swen
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ogol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eno
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\owt
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eerht
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ruof
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\evif
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\repiwoh
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ypszr
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\daolnwodi
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\putesprpgd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\onisacputes
…

Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
…

PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

»»»»» Searching by size/names…

»»»»»
Search five digit cs, dm and jb files.
This WILL/CAN also list Legit Files, Submit them at Virustotal
C:\WINDOWS\SYSTEM32\DMQGV.EXE 62,038 2002-08-29
C:\WINDOWS\SYSTEM32\DMXCY.EXE 62,038 2002-08-29
C:\WINDOWS\SYSTEM32\DMVQT.EXE 62,038 2002-08-29
C:\WINDOWS\SYSTEM32\DMMJZ.EXE 62,038 2002-08-29
C:\WINDOWS\SYSTEM32\DMWDK.EXE 62,038 2002-08-29
C:\WINDOWS\SYSTEM32\DMXFS.EXE 62,038 2002-08-29
C:\WINDOWS\SYSTEM32\DMZTG.EXE 62,038 2002-08-29
C:\WINDOWS\SYSTEM32\DMHMO.EXE 62,038 2002-08-29
C:\WINDOWS\SYSTEM32\DMSPI.EXE 62,038 2002-08-29

Other suspects.
Directory of C:\WINDOWS\system32
{6A007310-5C9B-439C-BDC5-C4249A96E9BC}.exe

»»»»» Misc files.

»»»»» Checking for older varients covered by the Rem3 tool.
******************************************************************

I will be looking forward to hearing what I need to do next. Thanks.