Spyware Problems Hijackthis log

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
O2 - BHO: (no name) - {2E65A557-173C-4DE9-860B-28FC5CACA542} - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Setup\Setup.dll
O3 - Toolbar: (no name) - {12EE7A5E-0674-42f9-A76B-000000004D00} - (no file)
O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKCU\..\Run: [Eojui] C:\WINNT\system32\d?dplay.exe
O4 - HKCU\..\Run: [Raaa] C:\Documents and Settings\kenc\Application Data\tont.exe
O4 - Global Startup: AccuWeather.com® Desktop.lnk = C:\Program Files\AccuWeatherDesktop\AccuWeatherDesktop.exe

ALL ABOVE SHOULD BE REMOVED

O10 - Unknown file in Winsock LSP: c:\winnt\system32\inetadpt.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\inetadpt.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\inetadpt.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\inetadpt.dll

To fix the you 'll need winsockfix : download it here http://www.itc.virginia.edu/desktop/central/display/versions.php3?softwareID=67&nav=title

good luck

ps. I recommend to remove the accuweatherdesktop because this software delivers adware to your pc.

Did you first post the results in the free HijackThis Analyzer link?  It is ideal to only post the line items that need help, rather than posting the entire log as noted here:
http://www.experts-exchange.com/Web/Browser_Issues/Q_21149514.html

Also curious if you've stayed current with WindowsUpdate for OS and IE and http://www.officeupdate.com for office related items to ensure you've installed needed patches/packs.

Also, checked the HOSTS file (no extension)?  AdAware SE Pro when updated is a great tool, when configured to do deep scanning and including the HOSTS file, as well as Spybot S&D, also when updated, and include the Immunize function to block more than 2300 intrusions, if not already done.

Have you also tried the Microsoft Malicious Software Removal tool (link in the following), as well as their AntiSpyware Beta application (with all updates)?
http://www.microsoft.com/security/incident/default.mspx

Microsoft Windows AntiSpyware (Beta) Home
Find out how to use the new Microsoft Windows AntiSpyware (Beta) to detect and remove spyware and other unwanted software that can track every move you make and compromise the personal information stored on your Windows computer..
http://www.microsoft.com/athome/security/spyware/software/default.mspx
Download Windows AntiSpyware (Beta)
Windows AntiSpyware (Beta) is a security technology that helps protect Windows users from spyware and other potentially unwanted software.
http://www.microsoft.com/downloads/details.aspx?FamilyId=321CD7A2-6A57-4C57-A8BD-DBF62EDA9671&displaylang=en
How to Protect Your Computer from Spyware and Adware
Describes how to determine if you have spyware or adware installed on your computer and how to get rid of it.
http://www.microsoft.com/windowsxp/using/security/expert/honeycutt_spyware.mspx

Prior to doing cleanup,  consider the System Restore issue so that the problem does not resurface if it remains 'on'.... and be sure to do a deep scan using updated virus definition files with a good viruscan program (again, deep scanning all HDs).

Asta

Also if using MSN Messenger, could also be 'open door' if not updates and/or configured correctly; or Windows Messenger, as noted below...
Disable Windows Messenger PopUps
http://www.hooverwebdesign.com/templates/stop-messenger.html

Sometimes, if files are in use, SAFE MODE works.

Best of luck to you,
Asta

right ,remove also:
-------------------------------------------------------
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
if this is not your own decision to receive blank screen at startup of your browser
-------------------------------------------------------
C:\WINNT\system32\ctfmon.exe
C:\WINNT\system32\d?dplay.exe
C:\Documents and Settings\kenc\Application Data\tont.exe  from starting up

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {2E65A557-173C-4DE9-860B-28FC5CACA542} - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Setup\Setup.dll
O3 - Toolbar: (no name) - {12EE7A5E-0674-42f9-A76B-000000004D00} - (no file)

O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [Eojui] C:\WINNT\system32\d?dplay.exe
O4 - HKCU\..\Run: [Raaa] C:\Documents and Settings\kenc\Application Data\tont.exe

O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)

O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44296DA} - http://www.addictivetechnologies.net/DM0/cab/Ud3rT0n5.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} - http://www.mt-download.com/MediaTicketsInstaller.cab

O16 - DPF: {DDFFA75A-E81D-4454-89FC-B9FD0631E726} - http://www.bundleware.com/activeX/DS3/DS3.cab

update the hijack log and posz back the new one,,,
besides ,also ggod software:
startup manager:
http://members.lycos.co.uk/codestuff/

heuristic tool:
http://www.winpatrol.com/download.html

later

Hi!

This is Experts-Exchange's policy concerning the posting of HijackThis logs:
http://www.experts-exchange.com/Web/Browser_Issues/Q_21149514.html
Don't worry: you haven't really broken any rules!  :)

In the future; if you have a HijackThis log that you'd like someone here to look at, do this -
Run HijackThis from a folder of it's own:something like -
C:\HJT\hijackthis. exe or C:\Program Files\HJT\hijackthis.exe
HJT makes backups and logfiles and it's a good idea to have them in one centralized place.

Also, the version of HijackThis you're using is outdated - latest ver. is 1.99.1
Download from here:
http://www.gatesofdelirium.com/ee/tools/

With all browser windows closed -
Run HijackThis -
Then copy and paste your log file into the Automatic Analysis site here:
http://www.hijackthis.de/index.php?langselect=english
Click on "Analyze" -
Then click on "Save Analysis" -
A page will open with your analyzed HJT log (this page will be saved for 3 days) -
Post a LINK to that page back here.
Please, do not post HJT logs here!

Someone will take a look at it.

You have other questionable entries showing in your log;
in addition to the one's davidis99 and MrAruba list above.

Good luck!

RF