PLEASE HELP! *SERIOUS* Adware/Trojan problem! I am helpless :(

Empty your Recyle Bin. This should have been done by Ccleaner which should have been run during the READ ME FIRST steps.

Did Symantec delete any of those files? You need to delete all of them from safe mode if it did not delete them.

Follow the steps below to post a HijackThis log.
- Download HijackThis 1.99.1

- Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

- Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

- Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

- Run HijackThis and save your log file.

- Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).

 

Your OS and IE version are way out of date and represent a major security risk to you. When we finish fixing you current problems you MUST get your system updated to help reduce the risk of continued problems like this.

Are the below StartPage settings valid:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neopets.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neopets.com/

Is this Clock G2 application valid? Are you sure?
C:\Program Files\Clock G2\Clock G2.exe

You may not have found all of the elitexxxx.exe files yet as shown in your HJT log.

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Please Print this out or save these instructions to a Notepad file and save it to your Desktop or someplace you can locate it to follow along with after rebooting to safe mode.
RESTART your Computer in SAFE MODE.

Click START>>>RUN>>>type in services.msc and hit Enter
In the next window, look on the right hand side for the below service name

aurmbnno

Double click on it and then STOP the service. In the drop down menu, change the startup type to Disabled. Now use Windows Explorer to find and delete this file: C:\WINDOWS\System32\bnno\aurm.exe

Now repeat the above for the below two services and filenames:
Service >>> ifnnoffhstsuh
Filename >>> C:\WINDOWS\System32\hstsuh\ifnnoff.exe

Service >>> makwnytkvwam
Filename >>> C:\WINDOWS\System32\nytkvwam\makw.exe


Stay in safe mode and run HijackThis click on the "Open the Misc Tools Section" button on the open page. Then select "Delete an NT service" on the left-hand side. A "Delete a Windows NT Service" window will pop up. Try entering the following into the box and then click OK:

aurmbnno

Then repeat the Delete an NT Service steps with the below two services:

ifnnoffhstsuh
makwnytkvwam

Now exit HijackThis and then re-run it again as follows. Run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
C:\WINDOWS\KEXDDLL.EXE
C:\WINDOWS\BWKMENC.EXE
C:\WINDOWS\System32\bnno\aurm.exe
C:\WINDOWS\System32\nytkvwam\makw.exe

After killing all the above processes, click "Back".

Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.exactsearch.net/sidesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: 216.39.69.102 view.atdmt.com

The next line is from SonyVaio but is considered spyware. It is upto you whether to fix this one or not:
O4 - HKLM\..\Run: [ZTgServerSwitch] c:\program files\support.com\client\lserver\server.vbs

O4 - HKLM\..\Run: [KEXDDLL] C:\WINDOWS\KEXDDLL.EXE
O4 - HKLM\..\Run: [BWKMENC] C:\WINDOWS\BWKMENC.EXE
O4 - HKLM\..\Run: [ifnnoff] C:\WINDOWS\System32\hstsuh\ifnnoff.exe
O4 - HKLM\..\Run: [cfgmgr51] RunDLL32.EXE C:\WINDOWS\cfgmgr51.dll,DllRun
O4 - HKLM\..\Run: [makw] C:\WINDOWS\System32\nytkvwam\makw.exe
O4 - HKLM\..\Run: [qglgysix] C:\WINDOWS\System32\ujcfc\qglgysix.exe
O4 - HKLM\..\Run: [aurm] C:\WINDOWS\System32\bnno\aurm.exe
O4 - HKLM\..\Run: [etbrun] C:\windows\system32\elitexxe32.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O23 - Service: aurmbnno - Unknown owner - C:\WINDOWS\System32\bnno\aurm.exe
O23 - Service: ifnnoffhstsuh - Unknown owner - C:\WINDOWS\System32\hstsuh\ifnnoff.exe
O23 - Service: makwnytkvwam - Unknown owner - C:\WINDOWS\System32\nytkvwam\makw.exe

After clicking Fix, exit HJT.
Run Windows Explorer to delete:
C:\WINDOWS\KEXDDLL.EXE
C:\WINDOWS\BWKMENC.EXE
C:\WINDOWS\System32\hstsuh\ifnnoff.exe <--- double checking
C:\WINDOWS\cfgmgr51.dll
C:\WINDOWS\System32\nytkvwam\makw.exe <--- double checking
C:\WINDOWS\System32\ujcfc\qglgysix.exe
C:\WINDOWS\System32\bnno\aurm.exe <--- double checking
C:\windows\system32\elitexxe32.exe <--- also look for and delete other files beginning with elite and ending with exe. There could be as many as ten more.

Now run Ccleaner (installed while running the READ ME FIRST).

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

 

You need to provide some feedback on all the steps. Were you able to do everything I requested? Did you locate the services and actually stop and disable them? Your current log shows an increase in malware which typically occurs when a fix is not followed completely or properly.

What happened while running the previous procedure?

Below is the current set of problem processes and registry entries you now have.
C:\WINDOWS\System32\yswmm\vtisx.exe
C:\WINDOWS\System32\dbufy\dogawio.exe
C:\WINDOWS\System32\dbufy\dogawio.exe
C:\WINDOWS\System32\dbufy\dogawio.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\yswmm\vtisx.exe
C:\WINDOWS\System32\yswmm\vtisx.exe

R3 - Default URLSearchHook is missing
O1 - Hosts: 216.39.69.102 view.atdmt.com
O4 - HKLM\..\Run: [ewcndtbg] C:\WINDOWS\System32\jirul\ewcndtbg.exe
O4 - HKLM\..\Run: [ichgv] C:\WINDOWS\System32\edsaehpw\ichgv.exe
O4 - HKLM\..\Run: [rnmkf] C:\WINDOWS\System32\gvfgrhxm\rnmkf.exe
O4 - HKLM\..\Run: [lkvccgp] C:\WINDOWS\System32\lfmio\lkvccgp.exe
O4 - HKLM\..\Run: [gtefv] C:\WINDOWS\System32\wfamrknv\gtefv.exe
O4 - HKLM\..\Run: [vtisx] C:\WINDOWS\System32\yswmm\vtisx.exe
O4 - HKLM\..\Run: [spjsandc] C:\WINDOWS\System32\ikpfpgfs\spjsandc.exe
O4 - HKLM\..\Run: [pxtjptb] C:\WINDOWS\System32\egxftp\pxtjptb.exe
O4 - HKLM\..\Run: [dogawio] C:\WINDOWS\System32\dbufy\dogawio.exe
O23 - Service: dogawiodbufy - Unknown owner - C:\WINDOWS\System32\dbufy\dogawio.exe
O23 - Service: lkvccgplfmio - Unknown owner - C:\WINDOWS\System32\lfmio\lkvccgp.exe
O23 - Service: rnmkfgvfgrhxm - Unknown owner - C:\WINDOWS\System32\gvfgrhxm\rnmkf.exe
O23 - Service: vtisxyswmm - Unknown owner - C:\WINDOWS\System32\yswmm\vtisx.exe

Can you locate these O23 lines Services and stop and then disable them?