Ugly mess you have there.  Better give it the full treatment:

I recommend that you do the following so you will have an electronic copy of the instructions since you will need to have Internet Explorer closed during most of the fix.

Select the instructions: Put your mouse at the top left corner of my post then hold down the left button and drag it down to the bottom of the post. 
Copy the instructins to your clipboard: Ctrl + c (or Edit, Copy). 
Start notepad:  Start, Run, notepad, OK
The cursor will be in notepad now so just Ctrl + v (or Edit, Paste) to paste the instructions into the notepad. 
Save the file:  File, Save As, (navigate to your desktop), fix, OK

You should now have a file called fix on your desktop which you can open by double clicking.

Download the Hoster from:

http://www.funkytoad.com/

Unpack to your desktop and run it.  If you have green print at the top then just press Restore Original Hosts then OK. 
IF you have red print then press make Hosts Writeable first.
After you Restore Original Hosts then press Make Hosts Read Only?
 

Get DelDomain.inf from:
 
http://www.mvps.org/winhelp2002/DelDomains.inf  and then right click on it and Install.  Nothing obvious will happen.

Get the latest version of ccleaner from:
 
from http://www.ccleaner.com.
 
(the actual download is at: http://www.filehippo.com/download_ccleaner/
click on Download Latest Version)
 
Install it.  Don't let it clean anything yet. 

Download the killbox:

http://www.bleepingcomputer.com/files/killbox.php

Unzip it to your desktop but don't run it.

Shutdown and Restart and Boot into Safe Mode by tapping the F8 key when you see the PC
maker's logo.
Keep tapping until it tells you it is going to Safe Mode or you see the Safe
Mode menu. Select the top option. Log in as your usual login or you won't find the programs you put on the desktop
and some of the entries we want to remove will not appear in HijackTHis.

Run HijackThis and just do a Scan only. Check  then Fix Checked any of the following that remain:
 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {173899D4-77FC-75E7-9E5A-B1DD4EE2B6E7} - C:\WINDOWS\system32\winyd32.dll
O2 - BHO: Class - {181EDD6C-335B-6475-7B7C-B04EFA3C4F99} - C:\WINDOWS\system32\apprb.dll
O2 - BHO: Class - {24817430-5142-4C7E-9CFF-0DCF7AC3D4C9} - C:\WINDOWS\system32\sysvf32.dll
O2 - BHO: Class - {2940FBDF-1F31-B348-ECE6-49CB795A24D6} - C:\WINDOWS\system32\addls32.dll
O2 - BHO: Class - {3F787872-61C2-E14A-5458-CFF5381DEA94} - C:\WINDOWS\atljh.dll
O2 - BHO: Class - {44FA143F-05A1-A796-536B-363BB7DC977C} - C:\WINDOWS\netxy32.dll
O2 - BHO: Class - {474BC714-CE9E-6D6E-EFD4-FC75E4F9B77C} - C:\WINDOWS\crqd.dll
O2 - BHO: Class - {4CEBAA3A-44D2-D30D-92A7-62004F8D1F39} - C:\WINDOWS\msjv32.dll
O2 - BHO: Class - {983BB056-EFD0-7204-73D3-F6E9D7EBA6AB} - C:\WINDOWS\system32\msyh32.dll
O2 - BHO: Class - {AD015E37-82EF-50C2-500E-8CAD04FC7E32} - C:\WINDOWS\ntvu32.dll
O2 - BHO: Class - {C47DCAF3-F99D-8C67-52D6-BC5A17E2D173} - C:\WINDOWS\system32\apizk32.dll
O2 - BHO: Class - {D1EB0EFD-8568-F7DC-B6ED-07BABD6B38F6} - C:\WINDOWS\system32\ipab32.dll
O2 - BHO: Class - {D58CC2B4-EB82-B5B9-733C-C5EBB3479058} - C:\WINDOWS\system32\d3th.dll
O2 - BHO: Class - {E18E7A68-3ADC-95BD-23E5-697B5C7438E7} - C:\WINDOWS\system32\ipwc.dll
O2 - BHO: Class - {EB78D545-7084-1460-B78B-C15169BF794D} - C:\WINDOWS\system32\msoz.dll
O2 - BHO: Class - {F33B84B4-9B35-0407-3C12-7ABB0397E43F} - C:\WINDOWS\system32\netgc32.dll
O2 - BHO: Internet Explorer Web Content Catcher  - {FFF4E223-7019-4ce7-BE03-D7D3C8CCE884} - C:\DNS\Catcher.dll
O4 - HKLM\..\Run: [winupdates] \winupdates\winupdates.exe /auto
O4 - HKLM\..\Run: [ggg] C:\WINDOWS\serveraa.exe
O4 - HKLM\..\Run: [Microsoft Windows DLL Services Configuration] windir32.exe
O4 - HKLM\..\Run: [Statistics] statslist.exe
O4 - HKLM\..\Run: [WinUpdate] C:\cmon.exe
O4 - HKLM\..\Run: [cruz.exe] C:\WINDOWS\system32\cruz.exe
O4 - HKLM\..\Run: [Windows XP Activation Crack] C:\Documents and Settings\jer\Shared\Windows XP Activation Crack.exe
O4 - HKLM\..\Run: [Windows XP home edition Activation] C:\Documents and Settings\jer\Shared\Windows XP home edition Activation.exe
O4 - HKLM\..\Run: [mfcan.exe] C:\WINDOWS\mfcan.exe
O4 - HKLM\..\RunServices: [Microsoft Windows DLL Services Configuration] windir32.exe
O4 - HKLM\..\RunServices: [Statistics] statslist.exe
O4 - HKCU\..\Run: [ggg] C:\WINDOWS\serveraa.exe
O4 - HKCU\..\Run: [Microsoft Windows DLL Services Configuration] windir32.exe
O4 - HKCU\..\Run: [Statistics] statslist.exe
O4 - HKCU\..\RunServices: [Statistics] statslist.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O13 - DefaultPrefix:
O13 - WWW Prefix:
O13 - Home Prefix:
O13 - Mosaic Prefix:
O13 - FTP Prefix:
O13 - Gopher Prefix:
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone (HKLM)
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\winxp32.exe
O23 - Service: NTBOOTMGR (NTBOOT) - Unknown owner - C:\WINDOWS\SYSTEM\DRIVER\ntuser.exe
O23 - Service: NTLOAD - Unknown owner - C:\WINDOWS\SYSTEM\DRIVER\ntsrv.exe
O23 - Service: NTSVCMGR - Unknown owner - C:\WINDOWS\SYSTEM\DRIVER\ntsrv.exe
 

 
Run ccleaner.exe,
 
Select Options then Advanced and uncheck the box in front of:
Only Delete file in Windows Temp folders older than 48 hours.
Now select Cleaner

Under Cleaner Settings, Windows
 uncheck everything on the first page
except:
 under Internet Explorer
   - Temporary Internet Files
 under System
  - Empty Recycle Bin
  - Temporary Files
Under Cleaner Settings, Applications uncheck everything
except:
 Under Internet
  - Sun Java
Run Cleaner.
 
This should clean out all of the temp files including those of your java program (where recently we are finding a lot of garbage.  You really should be running the latest version of java and uninstall all old versions).  The reason I have you uncheck most of the options is that I have had problems with it  deleting too much so I want to limit it to things where I think malware might be hiding.
 

Run killbox.  Open Options and check Remove Directories
Where it says Full Path of File to Delete you need to type or [copy (Hightlight and Ctrl + c)
and Paste (move to the killbox and place the cursor in the box and Ctrl + V)]:

C:\winupdates

Then check the Delete on Reboot box then the red button. 
It will say:  File Will Be Removed On Reboot, Do you want to reboot Now.
Tell it NO.  (If it can't find it that's OK just go on to the next one)
 
Repeat for:
C:\WINDOWS\system32\winxp32.exe
C:\WINDOWS\SYSTEM\DRIVER\ntuser.exe
C:\WINDOWS\SYSTEM\DRIVER\ntsrv.exe
 
C:\Documents and Settings\jer\Shared

Let it reboot after the last one.

Reboot into regular mode

Run another HijackThis log and post it as a reply. Let's
see how we did.

Ron

Reading up on your bug it loads a file:

tcp_systemstart.sys

which is disguised as a system driver so the program is run at start and it reinstalls everything.

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, locate and delete the following keys:
   
   • HKEY_LOCAL_MACHINE>System>CurrentControlSet>
     Enum>Root>LEGACY_MEDIASOURCE>0000
   • HKEY_LOCAL_MACHINE>System>CurrentControlSet>
     Services>MediaSource
   • HKEY_LOCAL_MACHINE>System>CurrentControlSet>
     Services>tcp-ip
3. Close Registry Editor.

Deleting Malware File

1. Right-click Start then click Search… or Find…, depending on the version of Windows you are running. (For Xp you need to select the advanced options to allow you to search system and hidden files and also to search subfolders)
2. In the Named input box, type each then do the search:
   
   • filter.dll
   • filter.ini
   • MsCtrl32ocx.exe
   • instsrv.exe
   • Jasfv.dll
   • msconfig.dll
   • restart.bat
   • Faa3.dll
   • tcp_setting.ocx
   • tcp_systemstart.sys
3. In the Look In drop-down list, select the drive that contains Windows, then press Enter.
4. Once located, select the file then press Delete.  If it won't delete then note the full path and see if Killbox can kill it.

Also run hijackthis (with IE closed) and check/Fix Checked all of the files that I told you to do before.  Also repeat the services.msc part.

Reboot and see if we made any impact on it.

If not