HELP!! SmitFraud Removal for Tommy

I have run SmitFraudFix to search, and here is the log. Please help me if you can. Is it ok to run SmitFraudFix to clean now?:confused. Also I am unable to log in in Safe Mode because of network restrictions where I work. Can I run in Normal Mode?

 

I went ahead and ran SmitFraudFix in Normal Mode. Attached is the log. Say a prayer

 

Well I found out how to run in Safe Mode (with Networking this time). So I ran SmitFraudFix to detect, then to clean, but I still have the trojan. Attached are my 2 logs. Any advice?

 

Ok I have removed unwanted programs, Run the cleanig program you suggested, and have run a search with SmitfraudFix (not a cleaning step yet). Attached is the search stage log. Vundo has also appeared this morning. Your help is greatly appreciated.

 

I have run all of the steps of READ & RUN ME ( only exception was that I was not able to find the Quarantine folder for Trend Micro Office Scan - all other quarantine items have been cleared), and I still have IE Windows popping up offering various services from investments to dating porn stars. None of the steps has stopped the file core.cache.dsk from reloading after startup (I started in Safe Mode following the last step of READ & RUN ME, and it was not present, but when I start in Normal Mode, it appears). Thanks for your assistance so far. Do you have any other advice?

 

Got ahead of myself. I'll try running the alternate scans first and get back to you

 

I did a little google research and found that core.cache.dsk never runs alone, it always has a partner to reinstall it in the event of removal. The file is sometimes called "core.sys", but in my case, core.sys disguised itself. It renamed itself as a sys file in the same directory as core.cache.dsk (c:\windows\system32\drivers\). In my case it was WudfRdd.sys, created at the same date/same time as the infection occurred. It was almost identical to another file WudfRd.sys, except for the repeated last character. Look for this trait. I then ran avenger and in the window I typed

Files to delete:
c:\windows\system32\drivers\WudfRudd.sys
c:\windows\system32\drivers\core.cache.dsk

I also checked "Scan for Rootkits", clicked Execute and ran it. I was instructed to reboot, and did. So far so good. If this doesn't work I'll pick up where I left off.

Thanks for all your help.