Google and Bing search engines are hijacked on my computer. Also, the XP Security Center doesn't open, even after I reset it to automatic.

Avast and MalwareBytes found nothing. Spybot S&D found and fixed many entries, but the problem persists. I tried running Avast, S&D, and MalwareBytes in Safe Mode with Networking, but the problem persists.

I will paste DDS.txt and aswMBR.txt below, and attach the DDS attach.zip file.

I will be away from my computer for two days, and will check back on Monday.

Thank you in advance for any help!


DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_35
Run by rob at 15:08:58 on 2012-09-28
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1406.456 [GMT -7:00]
.
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\acs.exe
svchost.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\lxedcoms.exe
C:\WINDOWS\system32\LxrJD31s.exe
C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\system32\TDispVol.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
C:\Program Files\Lexmark S600 Series\lxedmon.exe
C:\Program Files\Lexmark S600 Series\ezprint.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RAMASST.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
C:\Program Files\Spybot - Search & Destroy 2\SDWelcome.exe
C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Documents and Settings\rob\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\rob\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\rob\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\rob\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Intuit\QuickBooks 2006\qbw32.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Common Files\Intuit\QuickBooks\axlbridge.exe
C:\PROGRA~1\Intuit\QUICKB~1\QBDBMgr.exe
C:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32.exe
C:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uSearch Bar = hxxp://www.google.com/ie
uSearch Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mDefault_Page_URL = hxxp://www.toshibadirect.com/dpdstart
mDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy 2\SDHelper.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File
uRun: [IBP]
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Google Update] "c:\documents and settings\rob\local settings\application data\google\update\GoogleUpdate.exe" /c
uRunOnce: [SpybotDeletingF7843] "c:\program files\spybot - search & destroy 2\sddelfile.exe" "c:\windows\SchedLgU.Txt"
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [NDSTray.exe] NDSTray.exe
mRun: [TPSMain] TPSMain.exe
mRun: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
mRun: [TFncKy] TFncKy.exe
mRun: [TDispVol] TDispVol.exe
mRun: [CFSServ.exe] CFSServ.exe -NoClient
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup
mRun: [lxedmon.exe] "c:\program files\lexmark s600 series\lxedmon.exe"
mRun: [EzPrint] "c:\program files\lexmark s600 series\ezprint.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
mRun: [SDTray] "c:\program files\spybot - search & destroy 2\SDTray.exe"
mRunOnce: [SpybotDeletingE5136] "c:\program files\spybot - search & destroy 2\sddelfile.exe" "c:\windows\SchedLgU.Txt"
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\rob\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ramasst.lnk - c:\windows\system32\RAMASST.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {F4430FE8-2638-42e5-B849-800749B94EED}
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy 2\SDHelper.dll
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1348783863707
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{F80F7DEB-5040-4F02-8917-730A28570253} : DhcpNameServer = 192.168.1.254
Notify: AtiExtEvent - Ati2evxx.dll
Notify: SDWinLogon - SDWinLogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\rob\application data\mozilla\firefox\profiles\qeog174w.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.ups.com/content/us/en/index.jsx
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?sourceid=navclient&hl=en&q=
FF - component: c:\documents and settings\rob\application data\mozilla\firefox\profiles\qeog174w.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\documents and settings\rob\application data\mozilla\firefox\profiles\qeog174w.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar-ff3.dll
FF - component: c:\documents and settings\rob\application data\mozilla\firefox\profiles\qeog174w.default\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}\platform\winnt_x86-msvc\components\pagespeed.dll
FF - plugin: c:\documents and settings\rob\local settings\application data\google\update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPTURNMED.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_4_402_278.dll
FF - plugin: c:\windows\system32\npdeployJava1.dll
FF - plugin: c:\windows\system32\npptools.dll
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-9-27 729752]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-9-27 355632]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-9-27 21256]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2012-9-27 44808]
R2 lxed_device;lxed_device;c:\windows\system32\lxedcoms.exe -service --> c:\windows\system32\lxedcoms.exe -service [?]
R2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files\spybot - search & destroy 2\SDFSSvc.exe [2012-9-27 1074720]
R2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files\spybot - search & destroy 2\SDUpdSvc.exe [2012-9-27 1358360]
S0 Lbd;Lbd;c:\windows\system32\drivers\lbd.sys --> c:\windows\system32\drivers\Lbd.sys [?]
S2 lxedCATSCustConnectService;lxedCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxedserv.exe [2010-1-7 193192]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-6-8 250288]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-4-26 114144]
.
=============== Created Last 30 ================
.
2012-09-28 02:12:12 15224 ----a-w- c:\windows\system32\sdnclean.exe
2012-09-28 02:11:54 -------- d-----w- c:\program files\Spybot - Search & Destroy 2
2012-09-28 01:29:40 388096 ----a-r- c:\documents and settings\rob\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2012-09-28 01:29:39 -------- d-----w- c:\program files\Trend Micro
2012-09-28 01:21:09 -------- d-----w- c:\documents and settings\rob\application data\Product_RM
2012-09-28 01:21:09 -------- d-----w- c:\documents and settings\all users\application data\PC Tools
2012-09-28 00:59:25 -------- d-----w- c:\documents and settings\rob\application data\ElevatedDiagnostics
2012-09-27 22:04:35 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-09-27 22:04:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-09-27 21:24:10 729752 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-09-27 21:23:34 41224 ----a-w- c:\windows\avastSS.scr
2012-09-27 21:23:02 -------- d-----w- c:\program files\AVAST Software
2012-09-27 21:23:02 -------- d-----w- c:\documents and settings\all users\application data\AVAST Software
2012-09-27 00:07:09 114688 --sha-r- c:\windows\system32\EBPPORT3R.dll
2012-09-19 15:48:43 477168 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-09-07 01:29:37 114144 ----a-w- c:\program files\mozilla firefox\maintenanceservice.exe
2012-09-07 01:29:36 425952 ----a-w- c:\program files\mozilla firefox\libGLESv2.dll
2012-09-07 01:29:35 82400 ----a-w- c:\program files\mozilla firefox\libEGL.dll
2012-09-07 01:29:34 917984 ----a-w- c:\program files\mozilla firefox\firefox.exe
2012-09-07 01:29:34 258528 ----a-w- c:\program files\mozilla firefox\freebl3.dll
2012-09-07 01:29:34 2288608 ----a-w- c:\program files\mozilla firefox\gkmedias.dll
2012-09-07 01:29:33 2106216 ----a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll
2012-09-07 01:29:33 1998168 ----a-w- c:\program files\mozilla firefox\d3dx9_43.dll
2012-09-07 01:29:33 118240 ----a-w- c:\program files\mozilla firefox\crashreporter.exe
2012-09-07 01:29:28 73696 ----a-w- c:\program files\mozilla firefox\breakpadinjector.dll
2012-09-07 01:29:28 266720 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2012-09-07 01:29:28 18912 ----a-w- c:\program files\mozilla firefox\AccessibleMarshal.dll
.
==================== Find3M ====================
.
2012-09-20 21:07:33 73136 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-20 21:07:33 696240 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-09-19 15:48:22 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-09-19 15:48:21 473072 ----a-w- c:\windows\system32\deployJava1.dll
2012-08-30 20:29:36 81920 ----a-w- c:\windows\system32\ieencode.dll
2012-08-30 20:29:36 667136 ----a-w- c:\windows\system32\wininet.dll
2012-08-30 20:29:36 61952 ----a-w- c:\windows\system32\tdc.ocx
2012-08-28 13:00:25 369664 ----a-w- c:\windows\system32\html.iec
2012-07-06 13:58:51 78336 ----a-w- c:\windows\system32\browser.dll
2012-07-04 14:05:18 139784 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 13:40:15 1866112 ----a-w- c:\windows\system32\win32k.sys
2007-12-15 19:34:02 262144 ----a-w- c:\program files\Uninstall Spy Blocker.dll
.
============= FINISH: 15:12:55.26 ===============


aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-28 15:47:51
-----------------------------
15:47:51.250 OS Version: Windows 5.1.2600 Service Pack 3
15:47:51.250 Number of processors: 1 586 0xE08
15:47:51.250 ComputerName: TOSHIBA-USER UserName: rob
15:47:52.984 Initialize success
15:47:54.640 AVAST engine defs: 12092701
15:48:01.484 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
15:48:01.484 Disk 0 Vendor: HTS541080G9SA00 MB4OC60R Size: 76319MB BusType: 3
15:48:01.531 Disk 0 MBR read successfully
15:48:01.531 Disk 0 MBR scan
15:48:01.531 Disk 0 Windows XP default MBR code
15:48:01.546 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 76010 MB offset 63
15:48:01.562 Disk 0 Partition 2 00 88 Linux plaintext A Kárò'ó 305 MB offset 155669850
15:48:01.562 Disk 0 scanning sectors +156296385
15:48:01.640 Disk 0 scanning C:\WINDOWS\system32\drivers
15:48:20.171 Service scanning
15:48:42.531 Modules scanning
15:48:51.109 Module: C:\WINDOWS\System32\DLA\DLADResN.SYS **SUSPICIOUS**
15:48:53.515 Disk 0 trace - called modules:
15:48:53.546 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
15:48:53.546 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a689ab8]
15:48:53.546 3 CLASSPNP.SYS[f7657fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8a70cd98]
15:48:54.109 AVAST engine scan C:\WINDOWS
15:49:00.875 AVAST engine scan C:\WINDOWS\system32
15:52:05.609 AVAST engine scan C:\WINDOWS\system32\drivers
15:52:31.343 AVAST engine scan C:\Documents and Settings\rob
15:53:10.828 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\rob\My Documents\MALWARE\MBR.dat"
15:53:10.843 The log file has been saved successfully to "C:\Documents and Settings\rob\My Documents\MALWARE\aswMBR.txt"