Win32/Agent.ODG virus! Unable to remove! Please help

I have this problem, which is a Win32/Agent.ODG virus, according to a full system scan from NOD32. Here is the log from HijackThis: Pls help me with this problem! thanks

==================================================
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:38:08, on 26.04.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\System32\cisvc.exe
E:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
E:\Program Files\Java\jre6\bin\jqs.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\System32\igfxtray.exe
E:\WINDOWS\System32\hkcmd.exe
E:\WINDOWS\SOUNDMAN.EXE
E:\Program Files\Apoint2K\Apoint.exe
E:\WINDOWS\AGRSMMSG.exe
E:\WINDOWS\system32\rundll32.exe
E:\Program Files\Java\jre6\bin\jusched.exe
E:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
E:\Program Files\Apoint2K\Apntex.exe
E:\WINDOWS\system32\ctfmon.exe
E:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
E:\WINDOWS\system32\cidaemon.exe
E:\WINDOWS\system32\cidaemon.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\Documents and Settings\Mr. Tu\Desktop\HiJack(GP)This.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O1 - Hosts: 82.98.231.89 url.adtrgt.com
O1 - Hosts: 82.98.231.89 googleads2.gdoubleclick.net
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {9ab840f1-2e12-4687-95c2-8a412c0e2888} - E:\WINDOWS\system32\wisezeki.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IgfxTray] E:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] E:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Apoint] E:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [rufaridowa] Rundll32.exe "E:\WINDOWS\system32\refayuze.dll",s
O4 - HKLM\..\Run: [000000af] rundll32.exe "E:\WINDOWS\system32\febudipi.dll",b
O4 - HKLM\..\Run: [CPM1382bf55] Rundll32.exe "e:\windows\system32\zugovela.dll",a
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [egui] "E:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "E:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1207432100912
O20 - AppInit_DLLs: E:\WINDOWS\system32\tulowifi.dll e:\windows\system32\zugovela.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - e:\windows\system32\zugovela.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - e:\windows\system32\zugovela.dll
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - E:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - E:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - E:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - E:\Programs\MathLab7.0.1\webserver\bin\win32\matlabserver.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - E:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6133 bytes

Hello.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O1 - Hosts: 82.98.231.89 url.adtrgt.com
  O1 - Hosts: 82.98.231.89 googleads2.gdoubleclick.net
  O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
  O2 - BHO: (no name) - {9ab840f1-2e12-4687-95c2-8a412c0e2888} - E:\WINDOWS\system32\wisezeki.dll
  O4 - HKLM\..\Run: [rufaridowa] Rundll32.exe "E:\WINDOWS\system32\refayuze.dll",s
  O4 - HKLM\..\Run: [000000af] rundll32.exe "E:\WINDOWS\system32\febudipi.dll",b
  O4 - HKLM\..\Run: [CPM1382bf55] Rundll32.exe "e:\windows\system32\zugovela.dll",a
  O20 - AppInit_DLLs: E:\WINDOWS\system32\tulowifi.dll e:\windows\system32\zugovela.dll
  O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - e:\windows\system32\zugovela.dll
  O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - e:\windows\system32\zugovela.dll
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE or HERE.

• Click on Avenger.zip to open the file
  
• Extract avenger.exe to your desktop
  

Note: This tool was posted specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

2. Now, start The Avenger program by clicking on its icon on your desktop.

• Leave the script box empty.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

3. Please copy/paste the content of c:\avenger.txt into your reply.

Here is the content from Avenger.txt:
======================================
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at E:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver "ovfsthgomqskltfaivmpixuaxlknbmqppjwqxw" found!
ImagePath: \systemroot\system32\drivers\ovfsthkosgkvrjgknlmypdurwwbwwykpejdmrc.sys
Driver disabled successfully.

Rootkit scan completed.


Completed script processing.

*******************

Finished! Terminate.

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Drivers to delete:
ovfsthgomqskltfaivmpixuaxlknbmqppjwqxw

Files to delete:
e:\windows\system32\zugovela.dll
E:\WINDOWS\system32\febudipi.dll
E:\WINDOWS\system32\refayuze.dll
E:\WINDOWS\system32\wisezeki.dll
E:\WINDOWS\system32\drivers\ovfsthkosgkvrjgknlmypdurwwbwwykpejdmrc.sys

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

4. Please copy/paste the content of c:\avenger.txt into your reply.

Here is the log text again
=======================================
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at E:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Driver "ovfsthgomqskltfaivmpixuaxlknbmqppjwqxw" deleted successfully.
File "e:\windows\system32\zugovela.dll" deleted successfully.
File "E:\WINDOWS\system32\febudipi.dll" deleted successfully.
File "E:\WINDOWS\system32\refayuze.dll" deleted successfully.
File "E:\WINDOWS\system32\wisezeki.dll" deleted successfully.
File "E:\WINDOWS\system32\drivers\ovfsthkosgkvrjgknlmypdurwwbwwykpejdmrc.sys" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Here's the content of the log:
======================================
Malwarebytes' Anti-Malware 1.36
Database version: 2045
Windows 5.1.2600 Service Pack 3

26.04.2009 19:55:31
mbam-log-2009-04-26 (19-55-31).txt

Scan type: Quick Scan
Objects scanned: 88638
Time elapsed: 11 minute(s), 11 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 8
Registry Values Infected: 6
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 10

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
E:\WINDOWS\system32\tulowifi.dll (Trojan.Vundo) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9ab840f1-2e12-4687-95c2-8a412c0e2888} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9ab840f1-2e12-4687-95c2-8a412c0e2888} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\xpreapp (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
KHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\prnet (Trojan.Downloader) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\000000af (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm1382bf55 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rufaridowa (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\rhca77j0e3b9 (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo) -> Data: e:\windows\system32\tulowifi.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: e:\windows\system32\tulowifi.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
E:\WINDOWS\system32\tulowifi.dll (Trojan.Vundo) -> Delete on reboot.
E:\WINDOWS\system32\ovfsthqkorjerxroeddtffmkhxgdukxymcqdwf.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
E:\WINDOWS\system32\ovfsthqurtltoatpsaomaeiltemjfalpjnrqro.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
E:\Documents and Settings\Mr. Tu\Local Settings\Temp\ovfsthbvjixjkbxp.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.
E:\Documents and Settings\Mr. Tu\Local Settings\Temp\ovfsthqhwmfttosv.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
E:\Documents and Settings\Mr. Tu\Local Settings\Temp\rasesnet.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
E:\WINDOWS\system32\ovfsthakynlhhgrnsfrfamldsuhsrsyylxmlst.dll (Trojan.Agent) -> Quarantined and deleted successfully.
E:\WINDOWS\system32\ovfsthfxubrqoiuubbapphyynqldouhvmtbreu.dat (Trojan.Agent) -> Quarantined and deleted successfully.
E:\WINDOWS\system32\ovfsthgihmopjagqiwvrpcgekiwfjnbetcrnvi.dat (Trojan.Agent) -> Quarantined and deleted successfully.
E:\Documents and Settings\Mr. Tu\Local Settings\Temp\ovfsthlbyfqufgqs.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

Now, one more scan to make sure it's gone.

• Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
  Link 1
  Link 2
  
• Double click DDS.scr to run
  
• When complete, DDS.txt will open.
  
• Save the report to your Desktop.
  
• Copy and paste DDS.txt back here, I don't need to see attach.txt.
  

Here is the file:
=====================================

DDS (Ver_09-03-16.01) - NTFSx86
Run by Mr. Tu at 20:14:46,63 on 26.04.2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.495.256 [GMT 2:00]

AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Outdated)
AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated)
FW: ZoneAlarm Security Suite Firewall *disabled*

============== Running Processes ===============

E:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
E:\WINDOWS\System32\svchost.exe -k netsvcs
E:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
E:\WINDOWS\Explorer.EXE
svchost.exe
E:\WINDOWS\system32\spoolsv.exe
svchost.exe
E:\WINDOWS\System32\cisvc.exe
E:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
E:\Program Files\Java\jre6\bin\jqs.exe
E:\WINDOWS\System32\svchost.exe -k imgsvc
E:\WINDOWS\System32\igfxtray.exe
E:\WINDOWS\SOUNDMAN.EXE
E:\Program Files\Apoint2K\Apoint.exe
E:\WINDOWS\AGRSMMSG.exe
E:\Program Files\Java\jre6\bin\jusched.exe
E:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Apoint2K\Apntex.exe
E:\WINDOWS\system32\wscntfy.exe
E:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\WINDOWS\system32\cidaemon.exe
E:\WINDOWS\system32\cidaemon.exe
E:\Documents and Settings\Mr. Tu\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = about:blank
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - e:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - e:\program files\java\jre6\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - e:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - e:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [CTFMON.EXE] e:\windows\system32\ctfmon.exe
uRun: [MSMSGS] "e:\program files\messenger\msmsgs.exe" /background
uRun: [Yahoo! Pager] "e:\progra~1\yahoo!\messen~1\YAHOOM~1.EXE" -quiet
mRun: [IgfxTray] e:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] e:\windows\system32\hkcmd.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [Apoint] e:\program files\apoint2k\Apoint.exe
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [Adobe Reader Speed Launcher] "e:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [ZoneAlarm Client] "e:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [SunJavaUpdateSched] "e:\program files\java\jre6\bin\jusched.exe"
mRun: [egui] "e:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
dRun: [CTFMON.EXE] e:\windows\system32\CTFMON.EXE
StartupFolder: e:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - e:\program files\microsoft office\office10\OSA.EXE
IE: Nach Microsoft &Excel exportieren - e:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - e:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBC} - e:\program files\java\jre6\bin\jp2iexp.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - e:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1207432100912
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - e:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Notify: igfxcui - igfxsrvc.dll
AppInit_DLLs: e:\windows\system32\zugovela.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - e:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - e:\docume~1\mr1eef~1.tu\applic~1\mozilla\firefox\profiles\b2bftdaj.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com

============= SERVICES / DRIVERS ===============

R1 ehdrv;ehdrv;e:\windows\system32\drivers\ehdrv.sys [2009-4-9 107256]
R1 epfwtdir;epfwtdir;e:\windows\system32\drivers\epfwtdir.sys [2009-4-9 94360]
R1 Ext2fs;Ext2fs;e:\windows\system32\drivers\ext2fs.sys [2008-6-29 179584]
R1 IfsMount;IfsMount;e:\windows\system32\drivers\ifsmount.sys [2008-6-29 49536]
R1 KLIF;KLIF;e:\windows\system32\drivers\klif.sys [2009-2-7 127768]
R1 vsdatant;vsdatant;e:\windows\system32\vsdatant.sys [2008-12-23 394952]
R2 ekrn;ESET Service;e:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-4-9 731840]
S2 vsmon;TrueVector Internet Monitor;e:\windows\system32\zonelabs\vsmon.exe -service --> e:\windows\system32\zonelabs\vsmon.exe -service [?]
S3 USBZC0301;USB Web Camera;e:\windows\system32\drivers\usbcam.sys [2002-4-24 111272]

============== File Associations ===============

regfile=regedit.exe "%1" %*
scrfile="%1" %*

=============== Created Last 30 ================

2009-04-26 19:41 15,504 a------- e:\windows\system32\drivers\mbam.sys
2009-04-26 19:41 38,496 a------- e:\windows\system32\drivers\mbamswissarmy.sys
2009-04-26 19:41 --d----- e:\program files\Malwarebytes' Anti-Malware
2009-04-26 14:12 --d----- e:\program files\ESET
2009-04-26 14:10 73,728 a------- e:\windows\system32\javacpl.cpl
2009-04-22 03:00 --d----- e:\windows\system32\KB905474
2009-04-18 14:54 401,408 -c------ e:\windows\system32\dllcache\rpcss.dll
2009-04-18 14:54 284,160 -c------ e:\windows\system32\dllcache\pdh.dll
2009-04-18 14:54 473,600 -c------ e:\windows\system32\dllcache\fastprox.dll
2009-04-18 14:54 227,840 -c------ e:\windows\system32\dllcache\wmiprvse.exe
2009-04-18 14:54 110,592 -c------ e:\windows\system32\dllcache\services.exe
2009-04-18 14:54 729,088 -c------ e:\windows\system32\dllcache\lsasrv.dll
2009-04-18 14:54 453,120 -c------ e:\windows\system32\dllcache\wmiprvsd.dll
2009-04-18 14:54 714,752 -c------ e:\windows\system32\dllcache\ntdll.dll
2009-04-18 14:54 617,472 -c------ e:\windows\system32\dllcache\advapi32.dll
2009-04-18 14:49 2,560 -------- e:\windows\system32\xpsp4res.dll
2009-04-18 14:49 1,203,922 -c------ e:\windows\system32\dllcache\sysmain.sdb
2009-04-18 14:49 215,552 -c------ e:\windows\system32\dllcache\wordpad.exe
2009-04-18 13:09 --d----- e:\docume~1\mr1eef~1.tu\applic~1\COWON
2009-04-09 15:21 94,360 a------- e:\windows\system32\drivers\epfwtdir.sys
2009-04-09 15:18 107,256 a------- e:\windows\system32\drivers\ehdrv.sys
2009-04-09 15:10 113,960 a------- e:\windows\system32\drivers\eamon.sys

==================== Find3M ====================

2009-04-26 20:14 16,862,752 a--sh--- e:\windows\system32\drivers\fidbox.dat
2009-04-26 19:56 226,796 a--sh--- e:\windows\system32\drivers\fidbox.idx
2009-04-26 19:25 4,212 ----h--- e:\windows\system32\zllictbl.dat
2009-04-26 13:56 51,712 a--sh--- e:\windows\system32\gujayiwo.exe
2009-03-06 16:22 284,160 a------- e:\windows\system32\pdh.dll
2009-03-03 02:18 826,368 a------- e:\windows\system32\wininet.dll
2009-02-24 10:25 86,327 a------- e:\windows\pchealth\helpctr\offlinecache\index.dat
2009-02-20 20:09 78,336 a------- e:\windows\system32\ieencode.dll
2009-02-09 14:10 729,088 a------- e:\windows\system32\lsasrv.dll
2009-02-09 14:10 714,752 a------- e:\windows\system32\ntdll.dll
2009-02-09 14:10 617,472 a------- e:\windows\system32\advapi32.dll
2009-02-09 14:10 401,408 a------- e:\windows\system32\rpcss.dll
2009-02-09 13:13 1,846,784 a------- e:\windows\system32\win32k.sys
2009-02-07 19:02 2,066,048 a------- e:\windows\system32\ntkrnlpa.exe
2009-02-06 13:11 110,592 a------- e:\windows\system32\services.exe
2009-02-06 13:08 2,189,056 a------- e:\windows\system32\ntoskrnl.exe
2009-02-06 12:39 35,328 a------- e:\windows\system32\sc.exe
2009-02-03 21:59 56,832 a------- e:\windows\system32\secur32.dll
2008-08-24 12:59 1,090 a------- e:\program files\uninstal.log

============= FINISH: 20:15:42,94 ===============

Okay, one leftover file to get, but we'll deal with that soon. I need to see what's installed.

• Open HijackThis.
  
• When Hijack This opens, click "Open the Misc Tools section"
  
• Then select "Open Uninstall Manager"
  
• Click on "Save List..." (generates uninstall_list.txt)
  
• Click Save, copy and paste the results in your next post.
  

Here is the list:
==============================
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Flash Player ActiveX
Adobe Reader 8.1.2
Agere Systems AC'97 Modem
ALPS Touch Pad Driver
Compatibility Pack for the 2007 Office system
Critical Update for Windows Media Player 11 (KB959772)
Ext2 IFS 1.11 for Windows XP
Font Viet Nam
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
ImageJ 1.41o
Intel(R) Extreme Graphics Driver
J2SE Runtime Environment 5.0 Update 17
Java DB 10.4.1.3
Java(TM) 6 Update 11
Java(TM) 6 Update 7
Java(TM) SE Development Kit 6 Update 11
Malwarebytes' Anti-Malware
MATLAB Family of Products Release 14
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft Office Visio Professional 2003
Microsoft Office XP Professional with FrontPage
Microsoft User-Mode Driver Framework Feature Pack 1.0
Mozilla Firefox (3.0.8)
NTI CD & DVD-Maker 6 Gold
PowerDVD
Realtek AC'97 Audio
Realtek RTL8139/810x Fast Ethernet NIC Driver Setup
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961373)
SMSC IrCC Driver V5.1.2462.0 (WinXP)
TDH Autoplay
Total Commander (Remove or Repair)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Vietkey 4.09
Winamp
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Service Pack 3
WinRAR archiver
Yahoo! Messenger
ZoneAlarm Security Suite

Hello.

You are running two AV's, this is a bad idea as they can conflict and cause problems. I see Zonealarm and Nod32.
I would recommend that you remove Zonealarm to avoid conflict and other future problems.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

• J2SE Runtime Environment 5.0 Update 17
  
• Java(TM) 6 Update 11
  
• Java(TM) 6 Update 7
  
• ZoneAlarm Security Suite
  

Please download the OTMoveIt3 by OldTimer.

• Save it to your desktop.
  
• Please double-click OTMoveIt3.exe to run it.
  
• Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :files
  e:\windows\system32\gujayiwo.exe
  e:\program files\uninstal.log
  E:\Documents and Settings\Mr. Tu\Desktop\dds.scr
  
  
  
• Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt3
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

Here is the log:
=============================
========== FILES ==========
e:\windows\system32\gujayiwo.exe moved successfully.
e:\program files\uninstal.log moved successfully.
E:\Documents and Settings\Mr. Tu\Desktop\dds.scr moved successfully.

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04262009_204957

1. Now open a new notepad file.
   
2. Input this into the notepad file:
   

   
   Windows Registry Editor Version 5.00
   
   [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
   "AppInit_DLLs"=-
   "AppInit_DLLs"=""
   
   

   
   
3. Save this as fix.reg, save it to your desktop.
   
4. Double click fix.reg to run it.
   
5. Select yes to the registry merge prompt.
   
6. Delete the file once you have run it.
   

We can remove OTMoveIt now.

• Please double-click OTMoveIt3.exe to run it again.
  
• Press the green CleanUp! button.
  
• Press Yes cleanup process prompt, do the same for the reboot prompt.
  

How is the machine running now?

It's very good now, but one more point, the hard drive free space is now only 1.17 GB free/ 18.6 GB total. I don't see that on this computer has so many programs to occupy that much space. I remembered when I began to notice that there was signs of virus/malware on the computer, the OS popped up a balloon saying that it's "running low on hard drive space". I suspect this is caused by the virus/malware. Is there anyway to check it? (check whatsoever on the computer that occupies so much space). Thanks again for your very quick and effective help. It is very kind of you.

By the way, I have used this notebook for a few days, and before today there was never a balloon from the OS saying that it's "running low on space", just today, when I opened a few websites and realized that the system might have been infected (due to abnormal signs, eg: balloon, IE pop-ups, etc...), that's why I suspect that this would be caused by the virus/malwares

Last edited by express01 on 26th April 2009, 7:11 pm; edited 1 time in total

By the way, I have used this notebook for a few days, and before today there was never a balloon from the OS saying that it's "running low on space", just today, when I opened a few websites and realized that the system might have been infected (due to abnormal signs, eg: balloon, IE pop-ups, etc...), that's why I suspect that this would be caused by the virus/malwares

The malware is gone now, just keep Nod32 upto date.

Okay, lets do some cleaning.

Reset system restore

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.

Now, you can save disc space by dragging the system restore usage meter down. Bring it down to about 1% or 2%

Download ATF Cleaner

• Double-click ATF-Cleaner.exe to run the program.
  
• Click Select All found at the bottom of the list.
  
• Click the Empty Selected button.
  

If you use Firefox browser, do this also:

• Click Firefox at the top and choose Select All from the list.
  
• Click the Empty Selected button.
  
• NOTE : If you would like to keep your saved passwords, please click No at the prompt.
  

If you use Opera browser, do this also:

• Click Opera at the top and choose Select All from the list.
  
• Click the Empty Selected button.
  
• NOTE : If you would like to keep your saved passwords, please click No at the prompt.
  

Click Exit on the Main menu to close the program.

thank you very much for your help. It was very kind of you guys to provide such a wonderful service here!