Infected DLL files

Its been a few days that i have been infected. I usually get redirects when browsing the internet, pop ups and my computer is just a bit slower. Spyware doctor has been giving me warnings that various DLL files are trying to send information off my computer, which i have been blocking.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:35:25 PM, on 4/26/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Macallan\Macallan Mail Solution\MCPop3.exe
C:\Program Files\Macallan\Macallan Mail Solution\MCSmtp.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Advanced System Optimizer\startUp manager.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Spyware Doctor\TFEngine\TFService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: 82.98.231.89 url.adtrgt.com
O1 - Hosts: 82.98.231.89 googleads2.gdoubleclick.net
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.7.0\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {e563148f-ca57-4c49-83a9-975481f4e94d} - C:\WINDOWS\system32\pozimadu.dll (file missing)
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [TrayServer] C:\Program Files\MAGIX\Movie_Edit_Pro_14_PLUS_Download_version\TrayServer.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [togorutabi] Rundll32.exe "C:\WINDOWS\system32\sojamuli.dll",s
O4 - HKLM\..\Run: [CPM3be3ee30] Rundll32.exe "c:\windows\system32\yasasoya.dll",a
O4 - HKLM\..\Run: [38d0ddac] rundll32.exe "C:\WINDOWS\system32\lakayepo.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Startup Manager] "C:\Program Files\Advanced System Optimizer\startUp manager.exe"
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Samsung.PCSync] C:\Program Files\Samsung\Samsung PC Studio 7\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Samsung.PCSync] C:\Program Files\Samsung\Samsung PC Studio 7\PcSync2.exe /NoDialog (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Edit with Altova X&MLSpy - C:\Program Files\Altova\XMLSpy2008\spy.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.7.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.7.0\bin\ssv.dll
O9 - Extra button: Edit with Altova X&MLSpy - {2222EF56-F49E-4d07-A14E-8D2B08766958} - C:\Program Files\Altova\XMLSpy2008\spy.htm
O9 - Extra 'Tools' menuitem: Edit with Altova X&MLSpy - {2222EF56-F49E-4d07-A14E-8D2B08766958} - C:\Program Files\Altova\XMLSpy2008\spy.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1224113423046
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\zokelika.dll c:\windows\system32\yasasoya.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\yasasoya.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\yasasoya.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: eXist Native XML Database (eXist) - Unknown owner - C:\Program Files\eXist\tools\wrapper\bin\wrapper.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MCPop3 Service (MCPop3) - Macallan Applications - C:\Program Files\Macallan\Macallan Mail Solution\MCPop3.exe
O23 - Service: MCSmtp Service (MCSmtp) - Macallan Applications - C:\Program Files\Macallan\Macallan Mail Solution\MCSmtp.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\Spyware Doctor\TFEngine\TFService.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 12321 bytes

Hello.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O1 - Hosts: 82.98.231.89 url.adtrgt.com
  O1 - Hosts: 82.98.231.89 googleads2.gdoubleclick.net
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: (no name) - {e563148f-ca57-4c49-83a9-975481f4e94d} - C:\WINDOWS\system32\pozimadu.dll (file missing)
  O4 - HKLM\..\Run: [togorutabi] Rundll32.exe "C:\WINDOWS\system32\sojamuli.dll",s
  O4 - HKLM\..\Run: [CPM3be3ee30] Rundll32.exe "c:\windows\system32\yasasoya.dll",a
  O4 - HKLM\..\Run: [38d0ddac] rundll32.exe "C:\WINDOWS\system32\lakayepo.dll",b
  O20 - AppInit_DLLs: C:\WINDOWS\system32\zokelika.dll c:\windows\system32\yasasoya.dll
  O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\yasasoya.dll
  O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\yasasoya.dll
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Malwarebytes' Anti-Malware 1.36
Database version: 2043
Windows 5.1.2600 Service Pack 3

4/26/2009 2:14:34 PM
mbam-log-2009-04-26 (14-14-34).txt

Scan type: Quick Scan
Objects scanned: 87871
Time elapsed: 3 minute(s), 3 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 4
Registry Keys Infected: 7
Registry Values Infected: 6
Registry Data Items Infected: 5
Folders Infected: 0
Files Infected: 32

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\lakayepo.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\zokelika.dll (Trojan.Vundo.H) -> Delete on reboot.
c:\WINDOWS\system32\yasasoya.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\sojamuli.dll (Trojan.Vundo.H) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e563148f-ca57-4c49-83a9-975481f4e94d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e563148f-ca57-4c49-83a9-975481f4e94d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\xpreapp (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm3be3ee30 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\togorutabi (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup Manager (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\zokelika.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\zokelika.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\yasasoya.dll -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (Hijack.Help) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\boheyuje.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ejuyehob.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jaguwuyi.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iyuwugaj.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jefosodi.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\idosofej.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lakayepo.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\opeyakal.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\liwinise.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\esiniwil.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sutesuji.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ijusetus.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\yasasoya.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\sojamuli.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\zokelika.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\gavomiwi.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hofegope.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\muwuhare.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nipujija.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\perapola.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\piditupu.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rayogoga.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rayohupo.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sigowoto.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sihivubo.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tavuhefo.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tomuzipu.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\witagita.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\woyohipo.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yamanewa.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\Advanced System Optimizer\startUp manager.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vuwizodi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

i performed a second search and 0 files were detected
does this mean im now clean??

DDS (Ver_09-03-16.01) - NTFSx86
Run by Administrator at 14:45:18.50 on Sun 04/26/2009
Internet Explorer: 8.0.6001.18241 BrowserJavaVersion: 1.7.0
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.972 [GMT 1:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Macallan\Macallan Mail Solution\MCPop3.exe
C:\Program Files\Macallan\Macallan Mail Solution\MCSmtp.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Spyware Doctor\TFEngine\TFService.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrobat.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Documents and Settings\Administrator\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
BHO: IDMIEHlprObj Class: {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager\IDMIECC.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.7.0\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
BHO: FlashFXP Helper for Internet Explorer: {e5a1691b-d188-4419-ad02-90002030b8ee} - c:\progra~1\flashfxp\IEFlash.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [nodenable] c:\program files\eset\nodenable.exe
uRun: [IDMan] c:\program files\internet download manager\IDMan.exe /onboot
uRun: [Uniblue RegistryBooster 2] c:\program files\uniblue\registrybooster 2\RegistryBooster.exe /S
mRun: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
mRun: [IntelZeroConfig] c:\program files\intel\wireless\bin\ZCfgSvc.exe
mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\cli.exe" runtime -Delay
mRun: [TrayServer] c:\program files\magix\movie_edit_pro_14_plus_download_version\TrayServer.exe
mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice
mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe"
dRun: [Samsung.PCSync] c:\program files\samsung\samsung pc studio 7\PcSync2.exe /NoDialog
dRun: [IDMan] c:\program files\internet download manager\IDMan.exe /onboot
dRunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
uPolicies-explorer: NoResolveTrack = 1 (0x1)
uPolicies-explorer: NoInstrumentation = 1 (0x1)
uPolicies-explorer: NoSMMyPictures = 1 (0x1)
uPolicies-explorer: NoSMConfigurePrograms = 1 (0x1)
mPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1)
mPolicies-system: DisableCAD = 1 (0x1)
dPolicies-explorer: NoSMHelp = 1 (0x1)
dPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
dPolicies-explorer: NoResolveTrack = 1 (0x1)
dPolicies-explorer: NoInstrumentation = 1 (0x1)
dPolicies-explorer: NoSMMyPictures = 1 (0x1)
dPolicies-explorer: NoSMConfigurePrograms = 1 (0x1)
IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Download all links with IDM - c:\program files\internet download manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\internet download manager\IEGetVL.htm
IE: Download with IDM - c:\program files\internet download manager\IEExt.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Edit with Altova X&MLSpy - c:\program files\altova\xmlspy2008\spy.htm
IE: {2222EF56-F49E-4d07-A14E-8D2B08766958} - c:\program files\altova\xmlspy2008\spy.htm
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBC} - c:\program files\java\jre1.7.0\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1224113423046
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
20 ===============

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\dwu1mk3w.default\
FF - component: c:\documents and settings\administrator\application data\idm\idmmzcc2\components\idmmzcc.dll
FF - plugin: c:\program files\java\jre1.7.0\bin\npjava11.dll
FF - plugin: c:\program files\java\jre1.7.0\bin\npjava12.dll
FF - plugin: c:\program files\java\jre1.7.0\bin\npjava13.dll
FF - plugin: c:\program files\java\jre1.7.0\bin\npjava14.dll
FF - plugin: c:\program files\java\jre1.7.0\bin\npjava32.dll
FF - plugin: c:\program files\java\jre1.7.0\bin\npjpi170.dll
FF - plugin: c:\program files\java\jre1.7.0\bin\npoji610.dll
FF - plugin: c:\program files\pure codec\plugins\npqtplugin.dll
FF - plugin: c:\program files\pure codec\plugins\npqtplugin2.dll
FF - plugin: c:\program files\pure codec\plugins\npqtplugin3.dll
FF - plugin: c:\program files\pure codec\plugins\npqtplugin4.dll
FF - plugin: c:\program files\pure codec\plugins\npqtplugin5.dll
FF - plugin: c:\program files\pure codec\real\netscape6\nppl3260.dll
FF - plugin: c:\program files\pure codec\real\netscape6\nprjplug.dll
FF - plugin: c:\program files\pure codec\real\netscape6\nprpjplug.dll

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-4-17 64160]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-4-18 130424]
R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2009-4-18 51520]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2009-4-18 38208]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-2-6 106208]
R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2009-4-18 159600]
R2 ekrn;ESET Service;c:\program files\eset\eset smart security\ekrn.exe [2009-2-6 727720]
R2 MCPop3;MCPop3 Service;c:\program files\macallan\macallan mail solution\MCPop3.exe [2008-8-16 1302528]
R2 MCSmtp;MCSmtp Service;c:\program files\macallan\macallan mail solution\MCSmtp.exe [2008-8-16 1212416]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-4-18 348752]
R2 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-4-18 1095560]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2009-4-26 38496]
R3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [2009-4-18 64392]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2009-4-18 33088]
R3 ThreatFire;ThreatFire;c:\program files\spyware doctor\tfengine\tfservice.exe service --> c:\program files\spyware doctor\tfengine\TFService.exe service [?]
S2 EFix33;Nod32 AV;c:\windows\regedit.exe [2008-4-14 146432]
S2 eXist;eXist Native XML Database;c:\program files\exist\tools\wrapper\bin\wrapper.exe [2008-11-24 204800]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\magix\common\database\bin\fbserver.exe [2008-11-2 1527900]
S3 nmwcdsa;Samsung USB Phone Parent;c:\windows\system32\drivers\nmwcdsa.sys [2008-10-16 135680]
S3 nmwcdsac;Samsung USB Generic;c:\windows\system32\drivers\nmwcdsac.sys [2008-10-16 8320]
S3 nmwcdsacj;Samsung USB Port;c:\windows\system32\drivers\nmwcdsacj.sys [2008-10-16 12288]
S3 nmwcdsacm;Samsung USB Modem;c:\windows\system32\drivers\nmwcdsacm.sys [2008-10-16 12288]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2005-1-26 280344]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-1-18 951632]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe [2005-9-23 2799808]

=============== Created Last 30 ================

2009-04-26 14:10 --d----- c:\docume~1\admini~1\applic~1\Malwarebytes
2009-04-26 14:10 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-04-26 14:10 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-26 14:10 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-04-26 14:10 --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-04-26 13:35 --d----- c:\program files\Trend Micro
2009-04-25 17:41 2,713 ---sh--- c:\windows\system32\vorehuye.dll
2009-04-25 17:41 2,713 ---sh--- c:\windows\system32\lugapeda.exe
2009-04-25 17:41 2,713 ---sh--- c:\windows\system32\yasabetu.dll
2009-04-24 01:02 1,398,310 ---sh--- c:\windows\system32\uguziwub.ini
2009-04-23 01:02 121 ---sh--- c:\windows\system32\avevubuf.ini
2009-04-22 13:01 121 ---sh--- c:\windows\system32\itibuver.ini
2009-04-21 13:01 121 ---sh--- c:\windows\system32\avihimip.ini
2009-04-21 01:00 121 ---sh--- c:\windows\system32\etolaweh.ini
2009-04-20 01:00 121 ---sh--- c:\windows\system32\ahidoviv.ini
2009-04-19 13:00 121 ---sh--- c:\windows\system32\adunojol.ini
2009-04-19 01:03 1,400,655 ---sh--- c:\windows\system32\awekotuz.ini
2009-04-18 10:33 38,208 a------- c:\windows\system32\drivers\TfSysMon.sys
2009-04-18 10:33 33,088 a------- c:\windows\system32\drivers\TfNetMon.sys
2009-04-18 10:33 12,608 a------- c:\windows\system32\drivers\TfKbMon.sys
2009-04-18 10:33 51,520 a------- c:\windows\system32\drivers\TfFsMon.sys
2009-04-18 10:30 --d----- c:\windows\system32\oobe
2009-04-18 10:30 --d----- c:\windows\srchasst
2009-04-18 10:30 --d----- c:\windows\system32\xircom
2009-04-18 10:30 --d----- c:\program files\common files\speechengines
2009-04-18 10:30 --d----- c:\windows\system32\inetsrv
2009-04-18 10:30 --d----- c:\windows\system32\ime
2009-04-18 10:30 --d----- c:\program files\msn gaming zone
2009-04-18 10:19 159,600 a------- c:\windows\system32\drivers\pctgntdi.sys
2009-04-18 10:18 130,424 a------- c:\windows\system32\drivers\PCTCore.sys
2009-04-18 10:18 73,840 a------- c:\windows\system32\drivers\PCTAppEvent.sys
2009-04-18 10:18 64,392 a------- c:\windows\system32\drivers\pctplsg.sys
2009-04-18 10:18 --d----- c:\program files\common files\PC Tools
2009-04-18 10:18 --d----- c:\program files\Spyware Doctor
2009-04-18 10:18 --d----- c:\docume~1\alluse~1\applic~1\PC Tools
2009-04-18 10:18 --d----- c:\docume~1\admini~1\applic~1\PC Tools
2009-04-18 01:00 1,400,642 ---sh--- c:\windows\system32\erajozez.ini
2009-04-17 14:57 15,688 a------- c:\windows\system32\lsdelete.exe
2009-04-17 14:15 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-04-17 14:14 -cd-h--- c:\docume~1\alluse~1\applic~1\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-04-17 14:14 --d----- c:\program files\Lavasoft
2009-04-16 19:30 676,224 a------- c:\windows\system32\OGACheckControl.dll
2009-04-06 16:34 --d----- c:\docume~1\admini~1\applic~1\WinShell
2009-04-06 16:34 --d----- c:\program files\WinShell
2009-04-06 16:12 --d----- c:\docume~1\admini~1\applic~1\WinEdt
2009-04-06 16:11 --d----- c:\program files\WinEdt Team
2009-04-06 13:08 --d----- c:\docume~1\alluse~1\applic~1\MiKTeX
2009-04-06 13:01 --d----- c:\program files\MiKTeX 2.7
2009-04-06 12:44 --d----- C:\tex
2009-04-06 12:22 38,297 a------- c:\windows\system32\testpostprinter
2009-04-06 12:21 13,492 a------- c:\windows\system32\defprtr2.ppd
2009-04-03 18:21 --d----- C:\New Folder (2)
2009-04-03 18:20 --d----- C:\Setup
2009-03-30 20:09 --d----- c:\documents and settings\administrator\.eclipse
2009-03-29 23:12 --d----- C:\tc
2009-03-29 22:54 --d----- c:\program files\CVS Suite
2009-03-29 22:54 --d----- c:\program files\common files\March Hare Software Ltd

==================== Find3M ====================

2009-04-26 13:10 51,712 a--sh--- c:\windows\system32\gijiyeli.exe
2009-04-25 22:05 189,072 a------- c:\windows\system32\PnkBstrB.exe
2009-04-25 21:01 138,920 ac------ c:\windows\system32\drivers\PnkBstrK.sys
2009-04-25 13:28 98,304 a------- c:\windows\DUMP3846.tmp
2009-04-24 01:02 87,552 a--sh--- c:\windows\system32\yujolisa.dll
2009-04-23 13:47 98,304 a------- c:\windows\DUMP3c3d.tmp
2009-04-23 02:17 98,304 a------- c:\windows\DUMP41eb.tmp
2009-04-23 01:01 88,576 a--sh--- c:\windows\system32\mapagomu.dll
2009-04-22 13:01 88,576 a--sh--- c:\windows\system32\dekevimi.dll
2009-04-22 01:01 88,576 a--sh--- c:\windows\system32\yopufuju.dll
2009-04-22 01:01 51,200 a--sh--- c:\windows\system32\gujayiwo.exe
2009-04-21 13:01 87,552 a--sh--- c:\windows\system32\yinesuyi.dll
2009-04-21 13:01 50,688 a--sh--- c:\windows\system32\dagubawe.exe
2009-04-21 01:00 87,040 a--sh--- c:\windows\system32\sofefujo.dll
2009-04-20 13:00 87,040 a--sh--- c:\windows\system32\huwifibe.dll
2009-04-20 01:00 87,040 a--sh--- c:\windows\system32\jubateya.dll
2009-04-19 13:00 87,040 a--sh--- c:\windows\system32\kozewepu.dll
2009-04-19 01:03 87,040 a--sh--- c:\windows\system32\forareri.dll
2009-04-18 00:59 87,040 a--sh--- c:\windows\system32\yiyobuye.dll
2009-04-17 12:59 87,552 a--sh--- c:\windows\system32\wilawape.dll
2009-03-02 02:56 4,608 a------- c:\windows\system32\w95inf32.dll
2009-03-02 02:56 2,272 a------- c:\windows\system32\w95inf16.dll
2009-02-28 19:15 75,064 a------- c:\windows\system32\PnkBstrA.exe
2008-12-11 00:43 22,328 a------- c:\docume~1\admini~1\applic~1\PnkBstrK.sys
2008-11-02 02:26 75 -c-shr-- c:\windows\ICMET20.BIN

============= FINISH: 14:45:56.

Still some vundo to get rid of.

Please download the OTMoveIt3 by OldTimer.

• Save it to your desktop.
  
• Please double-click OTMoveIt3.exe to run it.
  
• Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :files
  c:\windows\system32\vorehuye.dll
  c:\windows\system32\lugapeda.exe
  c:\windows\system32\yasabetu.dll
  c:\windows\system32\uguziwub.ini
  c:\windows\system32\avevubuf.ini
  c:\windows\system32\itibuver.ini
  c:\windows\system32\avihimip.ini
  c:\windows\system32\etolaweh.ini
  c:\windows\system32\ahidoviv.ini
  c:\windows\system32\adunojol.ini
  c:\windows\system32\awekotuz.ini
  c:\windows\system32\erajozez.ini
  c:\windows\system32\gijiyeli.exe
  c:\windows\DUMP3846.tmp
  c:\windows\system32\yujolisa.dll
  c:\windows\DUMP3c3d.tmp
  c:\windows\DUMP41eb.tmp
  c:\windows\system32\mapagomu.dll
  c:\windows\system32\dekevimi.dll
  c:\windows\system32\yopufuju.dll
  c:\windows\system32\gujayiwo.exe
  c:\windows\system32\yinesuyi.dll
  c:\windows\system32\dagubawe.exe
  c:\windows\system32\sofefujo.dll
  c:\windows\system32\huwifibe.dll
  c:\windows\system32\jubateya.dll
  c:\windows\system32\kozewepu.dll
  c:\windows\system32\forareri.dll
  c:\windows\system32\yiyobuye.dll
  c:\windows\system32\wilawape.dll
  C:\Documents and Settings\Administrator\Desktop\dds.scr
  
  
  
• Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt3
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

========== FILES ==========
LoadLibrary failed for c:\windows\system32\vorehuye.dll
c:\windows\system32\vorehuye.dll NOT unregistered.
c:\windows\system32\vorehuye.dll moved successfully.
c:\windows\system32\lugapeda.exe moved successfully.
LoadLibrary failed for c:\windows\system32\yasabetu.dll
c:\windows\system32\yasabetu.dll NOT unregistered.
c:\windows\system32\yasabetu.dll moved successfully.
c:\windows\system32\uguziwub.ini moved successfully.
c:\windows\system32\avevubuf.ini moved successfully.
c:\windows\system32\itibuver.ini moved successfully.
c:\windows\system32\avihimip.ini moved successfully.
c:\windows\system32\etolaweh.ini moved successfully.
c:\windows\system32\ahidoviv.ini moved successfully.
c:\windows\system32\adunojol.ini moved successfully.
c:\windows\system32\awekotuz.ini moved successfully.
c:\windows\system32\erajozez.ini moved successfully.
c:\windows\system32\gijiyeli.exe moved successfully.
c:\windows\DUMP3846.tmp moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\yujolisa.dll
c:\windows\system32\yujolisa.dll NOT unregistered.
c:\windows\system32\yujolisa.dll moved successfully.
c:\windows\DUMP3c3d.tmp moved successfully.
c:\windows\DUMP41eb.tmp moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\mapagomu.dll
c:\windows\system32\mapagomu.dll NOT unregistered.
c:\windows\system32\mapagomu.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\dekevimi.dll
c:\windows\system32\dekevimi.dll NOT unregistered.
c:\windows\system32\dekevimi.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\yopufuju.dll
c:\windows\system32\yopufuju.dll NOT unregistered.
c:\windows\system32\yopufuju.dll moved successfully.
c:\windows\system32\gujayiwo.exe moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\yinesuyi.dll
c:\windows\system32\yinesuyi.dll NOT unregistered.
c:\windows\system32\yinesuyi.dll moved successfully.
c:\windows\system32\dagubawe.exe moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\sofefujo.dll
c:\windows\system32\sofefujo.dll NOT unregistered.
c:\windows\system32\sofefujo.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\huwifibe.dll
c:\windows\system32\huwifibe.dll NOT unregistered.
c:\windows\system32\huwifibe.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\jubateya.dll
c:\windows\system32\jubateya.dll NOT unregistered.
c:\windows\system32\jubateya.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\kozewepu.dll
c:\windows\system32\kozewepu.dll NOT unregistered.
c:\windows\system32\kozewepu.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\forareri.dll
c:\windows\system32\forareri.dll NOT unregistered.
c:\windows\system32\forareri.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\yiyobuye.dll
c:\windows\system32\yiyobuye.dll NOT unregistered.
c:\windows\system32\yiyobuye.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\wilawape.dll
c:\windows\system32\wilawape.dll NOT unregistered.
c:\windows\system32\wilawape.dll moved successfully.
C:\Documents and Settings\Administrator\Desktop\dds.scr moved successfully.

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04262009_153347

We can remove OTMoveIt now.

• Please double-click OTMoveIt3.exe to run it again.
  
• Press the green CleanUp! button.
  
• Press Yes cleanup process prompt, do the same for the reboot prompt.
  

How is the machine running now?