I ran afoul of CoolWebSearch to start with, so I got CWShredder to fix that. Then I kept having windows tell me that adware and spyware were on my system but ad-aware and Spyblocs couldn't find/remove. Then ee homepage kept being reset to about:blank. I joined ExpertExchange because they had a solution. Downloaded HijackThis and found about:blank. I saved a log of what HijackThis found, can someone look at it and tell me if any of the other programs on it are adware?
Logfile of HijackThis v1.97.7
Scan saved at 7:01:49 PM, on 6/24/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon
.exe
C:\WINNT\system32\services
.exe
C:\WINNT\system32\lsass.ex
e
C:\WINNT\system32\svchost.
exe
C:\WINNT\System32\svchost.
exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\brsvc01a
.exe
C:\WINNT\system32\spoolsv.
exe
C:\WINNT\System32\brss01a.
exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINNT\System32\SK9910DM
.EXE
C:\WINNT\GWMDMMSG.exe
C:\Program Files\Iomega HotBurn\Autolaunch.exe
C:\WINNT\System32\CTHELPER
.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINNT\SM1BG.EXE
C:\Program Files\Scansoft\PaperPort\p
ptd40nt.ex
e
C:\Program Files\iTunes\iTunesHelper.
exe
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\kdx\KHost.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\SpyBlocs\SpyBlocs.ex
e
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\FinePixViewer\QuickD
CF.exe
C:\Program Files\Hewlett-Packard\Digi
tal Imaging\bin\hpobnz08.exe
C:\Program Files\Microsoft Broadband Networking\MSBNTray.exe
C:\Program Files\Hewlett-Packard\Digi
tal Imaging\bin\hposol08.exe
C:\PROGRA~1\COMMON~1\AOL\A
CS\acsd.ex
e
C:\WINNT\system32\Brmfrmps
.exe
C:\PROGRA~1\Iomega\System3
2\AppServi
ces.exe
C:\Program Files\Hewlett-Packard\Digi
tal Imaging\bin\hpoevm08.exe
C:\Program Files\Nova Development\Photo Explosion Deluxe\CalCheck.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Scansoft\PaperPort\S
martUI\Sma
rtUI.exe
C:\WINNT\System32\NMSSvc.e
xe
C:\WINNT\System32\nvsvc32.
exe
C:\Program Files\Common Files\Lanovation\PrismXL\P
RISMXL.SYS
C:\WINNT\System32\svchost.
exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\System32\MsPMSPSv
.exe
C:\WINNT\System32\BRMFRSMG
.EXE
C:\Program Files\iPod\bin\iPodService
.exe
C:\Program Files\Hewlett-Packard\Digi
tal Imaging\Bin\hpoSTS08.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.
exe
R1 - HKCU\Software\Microsoft\In
ternet Explorer\Main,Search Bar = file://C:\DOCUME~1\Owner\L
OCALS~1\Te
mp\sp.html
R1 - HKCU\Software\Microsoft\In
ternet Explorer\Main,Search Page = file://C:\DOCUME~1\Owner\L
OCALS~1\Te
mp\sp.html
R1 - HKCU\Software\Microsoft\In
ternet Explorer\Search,SearchAssi
stant = file://C:\DOCUME~1\Owner\L
OCALS~1\Te
mp\sp.html
R1 - HKLM\Software\Microsoft\In
ternet Explorer\Main,Search Bar = file://C:\DOCUME~1\Owner\L
OCALS~1\Te
mp\sp.html
R1 - HKLM\Software\Microsoft\In
ternet Explorer\Main,Search Page = file://C:\DOCUME~1\Owner\L
OCALS~1\Te
mp\sp.html
R0 - HKLM\Software\Microsoft\In
ternet Explorer\Search,SearchAssi
stant = file://C:\DOCUME~1\Owner\L
OCALS~1\Te
mp\sp.html
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7
695ECA0567
0} - C:\WINNT\Downloaded Program Files\ycomp5_1_6_0.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-7
84B7D6BE0B
3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEH
elper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0
B5F309A0E6
4} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {8B7A9D7E-51D6-4A2A-BB24-F
F511FE9444
7} - C:\WINNT\System32\kegel.dl
l
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-F
ADC6B08487
2} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-2
09B6AD74AC
C} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-0
0A0C908246
7} - C:\WINNT\System32\msdxm.oc
x
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7
859DF00B1D
6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0
090271D4F8
8} - C:\WINNT\Downloaded Program Files\ycomp5_1_6_0.dll
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\UpdReg.EXE
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EX
E /AUTORUN
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Keyboard Preload Check] C:\OEMDRVRS\KEYB\Preload.e
xe /DEVID: /CLASS:Keyboard /RunValue:"Keyboard Preload Check"
O4 - HKLM\..\Run: [Jet Detection] C:\Program Files\Creative\SBAudigy\PR
OGRAM\ADGJ
Det.exe
O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn\Autolaunch.exe"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [SM1BG] C:\WINNT\SM1BG.EXE
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\p
ptd40nt.ex
e
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\I
ndexSearch
.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl03a\BrS
tDvPt.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.
exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe
" -atboottime
O4 - HKLM\..\Run: [kdx] C:\WINNT\kdx\KHost.exe
O4 - HKLM\..\Run: [SpyBlocs] C:\Program Files\SpyBlocs\SpyBlocs.ex
e
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe
" /background
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickD
CF.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digi
tal Imaging\bin\hpobnz08.exe
O4 - Global Startup: Microsoft Broadband Networking.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: Photo Explosion Calendar Checker.lnk = ?
O4 - Global Startup: SmartUI.lnk = ?
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: MoneySide (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.
dll
O16 - DPF: {02BCC737-B171-4746-94C9-0
D8A0B2C008
9} (Microsoft Office Template and Media Control) -
http://office.microsoft.com/templates/ieawsdc.cabO16 - DPF: {33564D57-0000-0010-8000-0
0AA00389B7
1} -
http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CABO16 - DPF: {62475759-9E84-458E-A1AB-5
D2C442ADFD
E} -
http://a1540.g.akamai.net/7/1540/52/20040427/qtinstall.info.apple.com/saba/us/win/QuickTimeInstaller.exeO16 - DPF: {739E8D90-2F4C-43AD-A1B8-6
6C356FCEA3
5} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX
.CAB
O16 - DPF: {74D05D43-3236-11D4-BDCD-0
0C04F9A3B6
1} (HouseCall Control) -
http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {90C9629E-CD32-11D3-BBFB-0
0105A1F0D6
8} (InstallShield International Setup Player) -
http://www.napster.com/client/isetup.cabO16 - DPF: {99CDFD87-F97A-42E1-9C13-D
18220D90AD
1} (StartFirstControl.CheckFi
rst) - hcp://system/StartFirstCon
trol.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-4
4455354000
0} (Shockwave Flash Object) -
http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cabO16 - DPF: {EF99BD32-C1FB-11D2-892F-0
090271D4F8
8} (Yahoo! Companion) -
http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_1_6_0.cabO16 - DPF: {F54C1137-5E34-4B95-95A5-B
A56D4D8D74
3} (Secure Delivery) -
http://www.gamespot.com/KDX/kdx.cab