Artemis Trojan and Firefox re-directs

[nlb23]

hello
Running XP SP3 and seem to be infected with trojan - every few minutes Mcafee reports a trojan removed "Artemis!CF78781CB298" - with folder name in temp - and windows tmp folder getting full of new entries.
Also Firefox re-directs every first click somewhere else - sometimes ebay, amazon, random security portals, often Ask...
Have Macafee installed and have tried, Stinger, MRT. MalwareBytes, PrevX, SAS and Spybot, ESET and all removed something...
searches leading me towards Combofix - hence asking you guys first.
HiJackthis Log attached
any suggestions?
many thanks
Noel

 

[Tmagic650]

You've still got some things in the hijackthis log. Go ahead and run combofix but follow the instructions carefully:
Combofix Instructions and download

 

[nlb23]

can't download combofix

hi,
thanks for the reply - tried both links and although download runs i get an error saying can't save combofix.exe - disk full or write-protected...
at the same time this attempt seems to generate trojan activity - macafee reporting blocked trojans (today pws z.bot has replaced artemis most of the time)...
is there a zip version i could try - or any other ideas...
thanks again

 

[Tmagic650]

Yes, it seems like Combofix is having some issues... In the mean time lets try running the ESET Scanner:

On-line Scanner

See if it picks up additional stuff

 

[nlb23]

Hello again and continuing thanks
ESET removed 6 threats...
McAfee popup warnings of Trojan PWS.zbot removed persist.
Browser re-directs appear to have gone - tho could be speaking too soon..
ran Hijackthis again and attach log.
cheers
noel

 

[nlb23]

also tried combofix again

after last efforts - redirects slowly reasserted themselves - successfully downloaded combofix - ran it and after rebooting got a Windows error saying SDRA64.exe failed to run - seemed like a good thing to me - hunted down its file and reg entry and removed...
strangely (I think) combofix didin't create a log file - or if it did I don't know where it is...
anyway - just run hijackthis again and attach new file in the hope you;ll say it's clean..
thanks for taking the time
noel