Need help with Trojan That has me Stumped

You need to do the stuff PP requested right away and after uninstalling those programs and getting the new HJT installed correctly, do the below (this is not a complete fix because I do not know the results of your new log and the uninstalls but I'm trying to get you past some of your problems).

First a question: Do you recognize this IP address. Appear to be some kind of web hosting site. They have hijacked your default prefixes.
69.50.191.50 = [ ]

OrgName: Atrivo
OrgID: ATRIV
Address: 200 Paul Avenue
City: San Francisco
StateProv: CA
PostalCode: 94124
Country: US
NetRange: 69.50.160.0 - 69.50.191.255
CIDR: 69.50.160.0/19
NetName: ATRIVOTECHNOLOGIES
NetHandle: NET-69-50-160-0-1
Parent: NET-69-0-0-0-0
NetType: Direct Allocation
NameServer: MAIL.ATRIVO.COM
NameServer: PAVEL.ATRIVO.COM
Comment:
Comment: Comments listed here will appear in ARIN's WHOIS database.
RegDate: 2003-06-04
Updated: 2003-08-21
NOCHandle: EKA4-ARIN
NOCName: Kacperski Emil
NOCPhone: 1-925-550-3947
NOCEmail: abuse@atrivo.com


Make sure you have system restore disabled and viewing of hidden files enabled (per the tutorial).
Please bring up Task Manager by hitting CTRL-ALT-DEL and click the Processes tab. Look for the below processes and if you find any of them, end them:
svchost
HHMS
WINMM64
PEHH
rces.exe
PEOR.EXE
S-S-ORMSSP
PENTPESY
S-S-ORSP
ydasjd
Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O2 - BHO: (no name) - {30192F8D-0958-44E6-B54D-331FD39AC959} - (no file)
O2 - BHO: (no name) - {62AF637B-9143-55E0-875E-64550FF62B38} - C:\WINDOWS\SYSTEM\NEIXDDLA.DLL (file missing)
O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\PROGRAM FILES\MYSEARCH\BAR\2.BIN\S4BAR.DLL
O2 - BHO: (no name) - {60F8377C-9017-0BB6-875E-64550FF42E62} - C:\WINDOWS\SYSTEM\ZCSNP.DLL
O3 - Toolbar: My Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - C:\PROGRAM FILES\MYSEARCH\BAR\2.BIN\S4BAR.DLL
O4 - HKLM\..\Run: [svchost] C:\WINDOWS\svchost.exe
O4 - HKLM\..\Run: [HHMS] C:\WINDOWS\SYSTEM32\HHMS.EXE
O4 - HKLM\..\Run: [CMESys] "C:\PROGRAM FILES\COMMON FILES\CMEII\CMESYS.EXE"
O4 - HKCU\..\Run: [SpywareGuardPlus] C:\WINDOWS\SYSTEM32\WINMM64.EXE
O4 - HKCU\..\Run: [HHMS] C:\WINDOWS\SYSTEM32\HHMS.EXE
O4 - HKCU\..\Run: [PEHH] C:\WINDOWS\SYSTEM32\PEHH.EXE
O4 - HKCU\..\Run: [Waea] C:\WINDOWS\Profiles\Joe\Application Data\rces.exe
O4 - HKCU\..\Run: [PEOR] C:\WINDOWS\SYSTEM32\PEOR.EXE
O4 - HKCU\..\Run: [S-S-ORMSSP] C:\WINDOWS\S-S-ORMSSP.EXE
O4 - HKCU\..\Run: [PENTPESY] C:\WINDOWS\PENTPESY.EXE
O4 - HKCU\..\Run: [S-S-ORSP] C:\WINDOWS\S-S-ORSP.EXE
O4 - HKCU\..\Run: [Rhzsjh] C:\WINDOWS\SYSTEM\ydasjd.exe
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab

Boot into safe mode and use Windows Explorer to delete:
C:\PROGRAM FILES\MYSEARCH <--- the whole directory
C:\WINDOWS\SYSTEM\ZCSNP.DLL
C:\WINDOWS\svchost.exe
C:\WINDOWS\SYSTEM32\HHMS.EXE
C:\PROGRAM FILES\COMMON FILES\CMEII <--- the whole directory
C:\WINDOWS\SYSTEM32\WINMM64.EXE
C:\WINDOWS\SYSTEM32\HHMS.EXE
C:\WINDOWS\SYSTEM32\PEHH.EXE
C:\WINDOWS\Profiles\Joe\Application Data\rces.exe
C:\WINDOWS\SYSTEM32\PEOR.EXE
C:\WINDOWS\S-S-ORMSSP.EXE
C:\WINDOWS\PENTPESY.EXE
C:\WINDOWS\S-S-ORSP.EXE
C:\WINDOWS\SYSTEM\ydasjd.exe

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

 

Yes, add those lines:
O13 - DefaultPrefix: http://69.50.191.50/?
O13 - WWW Prefix: http://69.50.191.50/?

to the list of lines to fix with HJT.

 

How are you attempting to get into safe mode? Try the methods given here:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406

Did you delete those previous files I gave you in normal mode? Or did you not delete them at all. They need to be deleted.

Did you look in Add/Remove programs for Ezula and Weboffer and uninstall them if found? If not, do so before continuing with below. If that works some lines I give below will no longer be found.


Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://s-redirect.com/?a=2&b=n-advert
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://s-redirect.com/?a=2&b=n-advert
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://s-redirect.com/?a=2&b=n-advert
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://s-redirect.com/?a=2&b=n-advert
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://s-redirect.com/?a=2&b=n-advert
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://s-redirect.com/?a=2&b=n-advert
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://69.50.191.52/668/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://s-redirect.com/?a=2&b=n-advert
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://s-redirect.com/?a=2&b=n-advert
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://s-redirect.com/?a=2&b=n-advert
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://s-redirect.com/?a=2&b=n-advert
O2 - BHO: (no name) - {60F8377C-9017-0BB6-875E-64550FF42E62} - C:\WINDOWS\SYSTEM\ZCSNP.DLL
O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe
O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe
O13 - DefaultPrefix: http://69.50.191.50/?
O13 - WWW Prefix: http://69.50.191.50/?

Boot into safe mode and use Windows Explorer to delete:
C:\WINDOWS\SYSTEM\ZCSNP.DLL
C:\PROGRA~1\ezula <--- the whole directory
C:\PROGRA~1\Web Offer <--- the whole directory


Now reboot normal and post a new HJT log. Tell me how things are working.

 

Please do not post logs inline. They must ALWAYS be as an attachment and must only be posted as requested (as in this case).

Your log is clean. You're welcome.