Unwanted redirector won't stay"fixed" in HJT

This particular item seems to be the cause of a page redirect that I am able to trigger by visiting, at least for sure, a certain page of my web site.

I have Win XP but I don't have windows update two installed yet. (I'd like to solve this problem first)

(from HJT log file)
"O17 - HKLM........92D}: NameServer = 69.50.184.86 85.255.112.9"

The ip addresses mean nothing to me. In fact I worry that some of the Estonian (85.255.112.9)servers pictures may cause me trouble with the law. I am able to "fix" the problem with HJT. However once I hit that certain web page again, the line item "017..." returns. I've followed all the cleansing suggestions etc (though I was unable to log on internet in safe mode.) And now to make matters worse I've got a racoon in my attic.

Any suggestions?

 

Download HijackThis 1.99.1

Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file as your backups will not be safely stored.

Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

Run HijackThis and save your log file.

Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post as it will be removed).

Need help with HJT? See this thread: NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

 

Here are the before and after HJT logs...as I said #17 keeps coming back.

 

Please download this trial version of ewido security suite

• Install ewido security suite
• Launch ewido, there should be an icon on your desktop double-click it.
• The program will prompt you to update click the OK button
• The program will now go to the main screen

You will need to update ewido to the latest definition files.

• On the left hand side of the main screen click update
• Click on Start

The update will start and a progress bar will show the updates being installed.

Now exit Ewido. Now print the below instructions or save them locally because I want you do have no browsers opened and also have no connection to the internet (unplug your cable) while doing the below.

Okay, after rebooting continue with the below steps.

Open up Ewido and do the following:

• Click on scanner
• Make sure the following boxes are checked before scanning:
  • 
    [*]Binder
    [*]Crypter
    [*]Archives
• Click on Start Scan
• Let the program scan the machine

While the scan is in progress you will be prompted to clean files, click OK

Once the scan has completed, there will be a button located on the bottom of the screen named Save report

• Click Save report
• Save the report to your desktop or anyplace you will be able to find it to upload here.

Reboot into normal mode and reconnect to the internet.

Come back here and post the Ewido Scan Report along with ONE fresh HJT log from normal mode.

 

Here's a couple of ewido report files run in one in safe mode with 0 connection. The another in safe mode with network support. A previous report was too large to upload...lots of cookie-type spyware found with a few trojans thrown in for good measure.

These lines in one report seems to identify a similiar html file name that seems to trigger my original complaint of a hijacked page.
pictures[1].ru -> Trojan.LowZones.bh : Cleaned with backup

picturez[1].ru -> Trojan.LowZones.bh : Cleaned with backup

however the line017 problem in HJT continues to return

 

Run CCleaner and then attach a fresh HJT log.