Please help a lost soul

Okay Dan, I enabled Spy Bot S&D's TeaTimer feature and I have immunised my system with S&D. I installed the Install MVPS Hosts File and I am in the process of updating windows.
Unfortunately, I don't think I am clean yet. I have just been using Firefox to browse and I find that sometimes my google searches are being hijacked.
When I click on google search results, instead of going to the target website I get directed to

hxxp://c.incomeppc.com/?d=rAbIxfhBdxNNE ... c3c6a78bba

When this happens I get a Page Load Error. Is this evidence of malware still on the computer?

Ok, let's have a look.

Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2

• Double-click GooredFix.exe to run it.
  
• Select 1. Find Goored (no fix) by typing 1 and pressing Enter.
  
• A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt).

Note: Do not run Option #2 yet.

dan

GooredFix v1.92 by jpshortstuff
Log created at 11:40 on 11/05/2009 running Option #1 (George)
Firefox version 3.0.10 (en-GB)

=====Suspect Goored Entries=====

C:\Program Files\Mozilla Firefox\extensions\{EEF22C20-BA1A-4FDD-97B2-CAB4BEE19625}

C:\Program Files\Mozilla Firefox\extensions\{75CC35EF-3014-4CB8-85CF-17A2B1AA6F0A}

C:\Program Files\Mozilla Firefox\extensions\{5F3D4111-EFA2-46C4-90CB-6185ABEAEAAC}
GooredFix Log:

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\mozilla firefox 3.0.10\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\mozilla firefox 3.0.10\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{20a82645-c095-46ed-80e3-08825760534b}"="C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"[removed]"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"[removed]"="C:\Program Files\eMusic Remote\remoteExt" (Folder Missing)

We may have it. Have to go out now but will check in with you later to see if you have had any redirects.

Please double-click GooredFix.exe on your Desktop to run it.

• Select "2. Fix Goored" by typing 2 and pressing Enter.
  
• Make sure all instances of Firefox are closed at this point.
  
• Type y at the prompt and press Enter again.
  
• A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt).

Note: If you receive a message saying that GooredFix needs your system to be restarted, please close all applications and reboot your system. Please also allow any registry changes that may be prompted by any of your security programs.

dan

GooredFix v1.92 by jpshortstuff
Log created at 12:02 on 11/05/2009 running Option #2 (George)
Firefox version 3.0.10 (en-GB)

=====Goored Deletions=====
C:\Program Files\Mozilla Firefox\extensions\{EEF22C20-BA1A-4FDD-97B2-CAB4BEE19625}
->Backing up folder... Done.
->Emptying folder... Done.
->Deleting folder... Done.
C:\Program Files\Mozilla Firefox\extensions\{75CC35EF-3014-4CB8-85CF-17A2B1AA6F0A}
->Backing up folder... Done.
->Emptying folder... Done.
->Deleting folder... Done.
C:\Program Files\Mozilla Firefox\extensions\{5F3D4111-EFA2-46C4-90CB-6185ABEAEAAC}
->Backing up folder... Done.
->Emptying folder... Done.
->Deleting folder... Done.

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\mozilla firefox 3.0.10\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\mozilla firefox 3.0.10\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{20a82645-c095-46ed-80e3-08825760534b}"="C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"[removed]"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"[removed]"="C:\Program Files\eMusic Remote\remoteExt" (Folder Missing)

How's it been since this morning?

I've had no more Firefox redirects. I also seemed to have solved Opera being very slow on the close by changing the memory cache size from 'automatic' to 20mb and then emptying the cache. Disk cache size is 20mb and I didn't change that.
Can I uninstall all the anti-malware programs from my computer now? Programs such as Malwarebytes' Anti-Malware. HijackThis! and GooredFix.

Dan I cannot thank you enough for your time, I am going to make a financial donation to malwareremoval

Thank you for your kind donation it will be appreciated.

let's just clear up goored fix for you.

malwarebytes is a good program to keep, just remember to update, before running a scan so you have the latest definitions available.

Click Start >> Run and then copy/paste the following into the box and hit Enter:
"%userprofile%\Desktop\GooredFix.exe" /uninstall
If any of your security programs query a new Registry/AutoStart value being added please allow the changes.

Was please dto here you had managed to solve the opera problem, have noted that myself.

Well if you have no questions I will wrap this one up and bid you good luck and safe surfing.
Kind regards dan

Any special instructions for the removal of HijackThis! ?

Go to control panel >"add and remove programs" click on HJT which will be highlighted, hit the remove button.
Hope that's helped.
dan

As this issue appears to be resolved,