hi
I notice that you have Spybot's TeaTimer running. While this is normally a wonderful tool to protect against hijackers, it can also interfere with HijackThis fixes. So please disable TeaTimer by doing the following:
- Run Spybot-S&D
- Go to the Mode menu, and make sure "Advanced Mode" is selected
- On the left hand side, choose Tools -> Resident
- Uncheck "Resident TeaTimer" and OK any prompts
You can reenable TeaTimer once your system is clean.
open hijackthis
click do a system scan only
checkmark these lines:
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [exe.qowmd] C:\WINDOWS\system32\dmwoq.exe
O4 - HKLM\..\Run: [exe.biomd] C:\WINDOWS\system32\dmoib.exe
O4 - HKLM\..\Run: [exe.aqimd] C:\WINDOWS\system32\dmiqa.exe
O4 - HKLM\..\Run: [exe.liimd] C:\WINDOWS\system32\dmiil.exe
O4 - HKLM\..\Run: [exe.ybomd] C:\WINDOWS\system32\dmoby.exe
O4 - HKLM\..\Run: [exe.zpemd] C:\WINDOWS\system32\dmepz.exe
O4 - HKLM\..\Run: [exe.egwmd] C:\WINDOWS\system32\dmwge.exe
O4 - HKLM\..\Run: [exe.xbsmd] C:\WINDOWS\system32\dmsbx.exe
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://webgames.d.tmsrv.com/c=56a936...ploader_v6.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{406C9523-64A0-4B8C-9906-5A03CF45D1C2}: NameServer = 85.255.114.198,85.255.112.176
O17 - HKLM\System\CCS\Services\Tcpip\..\{48DDFF77-B5A1-4902-956F-D13F84B95615}: NameServer = 85.255.114.198,85.255.112.176
O17 - HKLM\System\CCS\Services\Tcpip\..\{931F407E-D40A-4AC0-827B-69E6539CD182}: NameServer = 85.255.114.198,85.255.112.176
O17 - HKLM\System\CCS\Services\Tcpip\..\{F92F12BB-224A-4A61-ADA6-942A71AB70A0}: NameServer = 85.255.114.198,85.255.112.176
O17 - HKLM\System\CS1\Services\Tcpip\..\{406C9523-64A0-4B8C-9906-5A03CF45D1C2}: NameServer = 85.255.114.198,85.255.112.176
then close all other windows, leaving only hiajckthis running
and click fix checked
reboot
post a fresh hijackthis log