No, you have the Ukrainian DNS hijack (the O17 entries) often associates with a hidden Wareout infection and some older versions of Java which should be removed.  Run HJT, scan only and check these then Fix Checked. 

O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} (Java Plug-in 1.5.0_06) -
O16 - DPF: {CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA} (Java Plug-in 1.5.0_07) -
O16 - DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} (Java Plug-in 1.5.0_08) -
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} (Java Plug-in 1.5.0_09) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{18AD92CA-3E3D-433E-92CF-0DC9424EE043}: NameServer = 85.255.113.133,85.255.112.94
O17 - HKLM\System\CCS\Services\Tcpip\..\{546C8A7C-26D6-4556-8DFE-3F81CC84EC86}: NameServer = 85.255.113.133,85.255.112.94
O17 - HKLM\System\CCS\Services\Tcpip\..\{6FB2D54C-6798-48A0-BB22-5F8FBA4E4073}: NameServer = 85.255.113.133,85.255.112.94
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.133 85.255.112.94
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.133 85.255.112.94

Then reboot.  Make a new scan.  Do they come back?

 

Check for Hidden ADS Streams:
Run Hijackthis, OK the warning, then select "Open the Misc Tools Section", then
select Open ADS Spy.  Uncheck the box in front of Quick Scan, then press Scan.
When it finishes any ADS streams it find will be in the window above Scan.  If
it finds anything, press the Save Log button and save it somewhere.  It will
open the log in Notepad.  Edit, Select All to highlight the complete text of the
log then Edit, Copy then move to a reply to this post and Edit, Paste.
 
Check for High CPU Usage:
When it is running slow: Close all active programs then rightclick on the clock
and select Task Manager then select Processes. Click once or twice on the CPU
column heading until you get the bigger numbers at the top in that column.  What
are the top three processes and what % do they each take.  What does it say for
CPU usage at the bottom of the window?
 
Blacklight Rootkit Detector:
Download Blacklight trial from here: http://www.f-secure.com/blacklight/
Hit "I accept." It will take you to the download page. Download blbeta.exe and
save it to the Desktop. Once saved... double click blbeta.exe (you may not be
able to see the .exe) to install the program. Click Accept Agreement and click
Scan This app may trigger a warning from your antivirus. Let the driver load.
Wait for it to finish. If it displays any items...don't do anything with them
yet. Just hit exit (close) It will drop a log on Desktop that starts with
fsbl....big number
Please post contents of log in your next reply.

 

Ron

Hijackthis Ads Spy Scan

 

 

C:\Documents and Settings\Kyle Wooten\Favorites\Animal Crossing Community.URL : favicon  (1150 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\Apple.URL : favicon  (7782 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\Bungie Studio's.url : favicon  (2238 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\Crapville.URL : favicon  (824 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\Dark Strike1 Stat's.URL : favicon  (2238 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\Dell Community Forum.URL : favicon  (3638 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\Dell Online Contests.url : favicon  (3638 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\GameRenders.url : favicon  (3638 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\Halo 3, 3 Weeks of it!.url : favicon  (1150 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\Haloplanet.URL : favicon  (16958 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\ImageShack® - Hosting.URL : favicon  (1406 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\Ipod Cases.URL : favicon  (894 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\Ipod Scratch Removal.URL : favicon  (894 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\Ipod Updates.URL : favicon  (7782 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\LimeWire Pro.url : favicon  (1406 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\Microsoft\SamarkandsWorld (Powered by Invision Power Board).url : favicon  (1406 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\MySpace Ehs_Golfer.url : favicon  (1406 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\MySpace.url : favicon  (1406 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\Newegg.url : favicon  (1406 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\Pure Pwnage.url : favicon  (3638 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\Red vs Blue.URL : favicon  (894 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\Shareodie.URL : favicon  (1406 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\VideoPimp.URL : favicon  (1406 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\Windows XP Tweaks.URL : favicon  (1150 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\Xbox 360 Forum's.url : favicon  (1150 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\Xbox 360 Skin.url : favicon  (1150 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\Xbox Website.URL : favicon  (894 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\Yahoo! Music.URL : favicon  (318 bytes)
C:\Documents and Settings\Kyle Wooten\Favorites\Yahoo!.url : favicon  (6598 bytes)
C:\WINDOWS\system32 : {DA6227CB-326B-4B4D-9A81-04B81F1538DD}  (12 bytes)
C:\WINDOWS\system32 : {DA6227CB-326B-4B4D-9A81-04B81F1538DD}  (12 bytes)

 

 

 

Rootkit Scan (1 Item Found)

 

 

01/07/07 13:47:44 [Info]: BlackLight Engine 1.0.55 initialized
01/07/07 13:47:44 [Info]: OS: 5.1 build 2600 (Service Pack 2)
01/07/07 13:47:44 [Note]: 7019 4
01/07/07 13:47:44 [Note]: 7005 0
01/07/07 13:47:49 [Note]: 7006 0
01/07/07 13:47:49 [Note]: 7011 1736
01/07/07 13:47:49 [Note]: 7026 0
01/07/07 13:47:50 [Note]: 7026 0
01/07/07 13:47:53 [Note]: FSRAW library version 1.7.1021
01/07/07 13:52:37 [Info]: Hidden file: c:\WINDOWS\system32\kddro.exe
01/07/07 13:52:37 [Note]: 7002 32
01/07/07 13:52:37 [Note]: 7003 1
01/07/07 13:52:37 [Note]: 10002 1
01/07/07 13:54:55 [Note]: 7007 0

I think Blacklight has an option to rename a bad file tho I can't tell you exactly how to do that.  If you can figure it out then tell it to rename or delete this file:

c:\WINDOWS\system32\kddro.exe
 Then reboot and run it again.

 

Otherwise:

Download the killbox:

http://www.bleepingcomputer.com/files/killbox.php

Unzip it to your desktop but don't run it.

 

Shutdown and Restart and Boot into Safe Mode by tapping the F8 key when you see
the PC maker's logo.
Keep tapping until it tells you it is going to Safe Mode or you see the Safe
Mode menu. Select the top option. Log in as your usual login.

 

Run killbox.  Where it says Full Path of File to Delete you need to type or copy (Highlight
and Ctrl + c)
and Paste (move to the killbox and place the cursor in the box and Ctrl + V):

 

c:\WINDOWS\system32\kddro.exe

 

Then check the Delete on Reboot box
then the red button. 
It will say:  File Will Be Removed On Reboot, Do you want to reboot Now.

 

Say Yes.

 

After it reboots verify with Blacklight that the file is no longer running.  Make a new HJT log and post it as a reply.

 

Ron

I ran Killbox in safemode and it said "File kddro.exe could not be deleted."

You can try  Blacklight's Rename.  Run the Blacklight scan again and then highlight the file and press Rename and reboot.  See if it is still there when you come back up.  I found this tutorial on using it:

 

http://www.bleepingcomputer.com/tutorials/tutorial124.html

 

If you've already tried it then you can try booting into Safe Mode and this time select Command Prompt then once you get to the black screen type:

 

cd \windows\system32

 

attrib -r -a -h -s kddro.exe

 

del /f kddro.exe

 

mkdir kddro.exe

 

(Then Ctrl + Alt + Delete and select Shutdown and reboot into regular mode.)

 

You can also try the Wareout removal tools as described here:

http://forums.majorgeeks.com/showthread.php?t=95472

 

IF that doesn't work we can try ice sword.  This one is a pain to use since it is not available in zip format but is in rar so we have to download a second program to unpack it.  To make matters worse there is no Help file or tutorial on it that I know of.  The original program was written in China.

 

Get the Ice Sword program from:

http://majorgeeks.com/Icesword_d5199.html

IE will probably block the download and tell you it did so in a line at the top.  Click on the line and it will let you tell it to download the file.  Save it to your desktop.

You won't be able to unzip it yet.

 

We need to get 7-zip for that.

http://www.7-zip.org/

Click on the Download link just below where it says:
Download 7-Zip 4.42 (2006-05-14) for Windows:

or just click on this link.

http://prdownloads.sourceforge.net/sevenzip/7z442.exe?download

IE will probably block the download and tell you it did so in a line at the top.  Click on the line and it will let you tell it to download the file.  Save it to your desktop.

 

Run the 7z442.exe file, Install, then put it on your desktop by Browse then point to the desktop.   It should create a folder called 7-zip.  Open the folder and run 7ZFM.exe.  Then when 7-zip opens, doubleclick on the Computer in the bottom pane. Then doubleclick on C: then on Documents a.(Documents and Settings is the full name but you won't see all of it unless you increase the column width)  then on your loginname then on Desktop.  You should now see the Icesword1.18.rar  Click once on it then on the big minus at the top (Extract) .  It will want to know where to put it.  Put it on the desktop.

 

Now close 7-zip, boot into Safe Mode and open the icesword1.18 folder on your desktop.  You will find another folder inside.  Open it too.  Now doubleclick on IceSword.exe.  (you may not see the .exe) It should open with a blank pane and a column of icons on the left.

 

 

Click on the first icon in the left column of icons and look in the right pane.  Look for any lines in red.  These are hidden files.  Sometimes these are good guys from zone alarm or an antivirus but often they are evildoers.  Write down their names and tell me.  Repeat for each Icon in the left panel except the last couple which talk about logs.  If you find our hidden friend rightclick on it and see if there is an option to delete or stop the process or service. 

 

Click on the left section that says Files and navigate to C:\Windows\System32.  See if you can find our friend and rightclick on him and Delete him.

 

Ron