Pop-ups and Mozzilla not working

First off, I did read the DO NOT POST UNTIL YOU HAVE READ THIS: How to: Spyware, Trojan And Virus Removal thread and did everything there.

Briefly, last week I got a popup message asking if I wanted to upgrade to the most current version of Ad-Aware. I have Ad-Aware and knowing that it was a very good program I clicked yes I wanted to get the most current. It's possible I mis-read the message but I know what I got was not a new version of Ad-Aware and among other things I got Ad-Destroyer (which doesn't destroy ad's btw, it invites them in.) I've spent the last week fighting spyware and at least one keylogger.

But it's not fixed and my current problems are:

1) I'm still getting popups. Much less than a few days ago but they are still there.

2) I still can't get Mozilla Firefox to work. (I've removed, scanned and reinstalled and still no luck.)

3) Anything I've mesed up while trying to fix the rest.

I've run through everything on the link above except for some reason I couldn't run RavAntivirus (I can't remember why at the moment).

Notable things:
Nortons anti-virus found:
pho_prob.exe
dlmax.dll

Delete failed

Trend Micro's Free Online Virus Scan:

EXPL IFRAMEDBO.A - Non Cleanable
C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Temorary Internet Files\Content.IE5\STQFSDEE3\Counter[1].js

TSPY DLOADER.D - Non Cleanable
c:WINDOWS\SYSTEM32\lypjcyf.exe

CC Cleaner:
Analyze found:
C:WINDOWS\TEMP\THI6311.tmp\dlmax.inf 407 bytes
C:WINDOWS\TEMP\THI6311.tmp\dlmax.dll 0.16 MB bytes
C:WINDOWS\TEMP\DrTemp\bho_prob.exe 69.00 KB

But when I choose "Run Cleaner" I get the message it was complete but 0 bytes removed.

BitDefender Online:
C:\WINDOWS\TEMP\DrTemp\bho_prob.exe Infected with: Trojan.Downloader.Agent.AF
C:\WINDOWS\TEMP\DrTemp\bho_prob.exe Disinfection failed
C:\WINDOWS\TEMP\DrTemp\bho_prob.exe Delete failed

And I keep running into recurring files in my attempts
IE Plugin: c:Windows\lu.dat
pho_prob.exe
dlmax.dll

Hopefully someone sees this and things "obviously <fill in the blank> is the problem just do this"

 

Update

I was able to manually remove:
C:WINDOWS\TEMP\THI6311.tmp\dlmax.inf 407 bytes
C:WINDOWS\TEMP\THI6311.tmp\dlmax.dll 0.16 MB bytes
C:WINDOWS\TEMP\DrTemp\bho_prob.exe 69.00 KB

So far (knock on wood) I haven't gotten any more pop-ups. But Mozilla Firefox still isn't working so I don't think I am clean yet.

Is there any registry work that goes along with removing those files?

 

I definitely would like to make sure I'm clean. I'm pretty sure there were a couple others before ABetterInternet. I'm also wondering if there is something left that is interfering with Mozilla FireFox working

I've attached the log here.

 

I did as you suggested. I choose to remove:
O4 - HKLM\..\Run: [QD FastAndSafe] "C:\Program Files\QuickTime\qttask.exe" -atboottime

And checked and removed all the items in the list.

I had managed to remove these last night finally:
C:\WINDOWS\NQBYENC.EXE
C:\WINDOWS\KNHTDLL.EXE

After I removed those files last night things seem to be working. At least no pop-ups at all. Mozilla FireFox still does not work. Where should I post about it or do you think it is still related?

 

First off it launches abnormally slow. Easily 5 or 6 times as long to open as it used to. Once it is open, absolutely nothing works. You can't open any of the menues or type in the URL field.

I have given it access through the firewall. I have tried temporarily disabling Nortons Internet Security firewall and it makes no difference. I've removed Firefox, rebooted, re-downloaded the installer and then reinstalled it. Still no difference.

 

Oh how exciting!

I ran those three check. The first found something in Norton's quarantine, the second found something in Microsoft's AntiSpyware's quarantine and the third found nothing.

I thought I had tried what you suggested for Firefox but did it again just in case. This time when I rebooted I went into safe mode and did searches and deleted anything related to "Firefox" or "Mozilla". Now this message brought to you through FireFox!

So now I'm busy with the registry. I'm cleaning Registry Medic.

I assume you meant upload and not post my HJT file so I attached it here

BTW - my score on 3DMark2001se didn't change noticably. Should it have?