Problem with BHO's being added!

[JEP]

Can anybody review my hijack this log and tell me what I need to fix. I have BHO's being added every 2-3 mins. Spyguard removes them but not the cause.

Cheers

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\sysrn.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ippj.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\MRU-Blaster\scheduler.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\StartupList\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/uk/enu/gen/default.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\jpfnk.dll/sp.html#28129
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.pc-q.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Tiscali 10.0
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {CA174FF9-A873-F9AD-4D62-A2FCAC3BFD4F} - C:\WINDOWS\d3lj32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [WebScan] C:\PROGRA~1\ACCELE~1\ANTI-V~1\DEFSCA~1.EXE -k
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ippj.exe] C:\WINDOWS\system32\ippj.exe
O4 - HKLM\..\Run: [Dsi] C:\WINDOWS\System32\dp-k13w13.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\RunOnce: [ntgw.exe] C:\WINDOWS\ntgw.exe
O4 - HKLM\..\RunOnce: [d3uc32.exe] C:\WINDOWS\system32\d3uc32.exe
O4 - HKLM\..\RunOnce: [sdkih.exe] C:\WINDOWS\system32\sdkih.exe
O4 - HKLM\..\RunOnce: [ipnn.exe] C:\WINDOWS\ipnn.exe
O4 - HKLM\..\RunOnce: [sysrn.exe] C:\WINDOWS\sysrn.exe
O4 - HKLM\..\RunOnce: [sysiw32.exe] C:\WINDOWS\system32\sysiw32.exe
O4 - HKLM\..\RunOnce: [ntvw.exe] C:\WINDOWS\ntvw.exe
O4 - HKLM\..\RunOnce: [ieit32.exe] C:\WINDOWS\system32\ieit32.exe
O4 - HKLM\..\RunOnce: [crss32.exe] C:\WINDOWS\crss32.exe
O4 - HKLM\..\RunOnce: [winci32.exe] C:\WINDOWS\system32\winci32.exe
O4 - HKLM\..\RunOnce: [ievw32.exe] C:\WINDOWS\system32\ievw32.exe
O4 - HKLM\..\RunOnce: [d3jv.exe] C:\WINDOWS\d3jv.exe
O4 - HKLM\..\RunOnce: [d3md.exe] C:\WINDOWS\d3md.exe
O4 - HKLM\..\RunOnce: [netsm32.exe] C:\WINDOWS\system32\netsm32.exe
O4 - HKLM\..\RunOnce: [mfcwo.exe] C:\WINDOWS\mfcwo.exe
O4 - HKLM\..\RunOnce: [javako32.exe] C:\WINDOWS\javako32.exe
O4 - HKLM\..\RunOnce: [systb.exe] C:\WINDOWS\systb.exe
O4 - HKLM\..\RunOnce: [addwk32.exe] C:\WINDOWS\system32\addwk32.exe
O4 - HKLM\..\RunOnce: [msio.exe] C:\WINDOWS\msio.exe
O4 - HKLM\..\RunOnce: [apprk.exe] C:\WINDOWS\apprk.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [nsdriver] C:\WINDOWS\System32\nssys32.exe
O4 - Startup: MRU-Blaster Scheduler.lnk = C:\Program Files\MRU-Blaster\scheduler.exe
O4 - Startup: MRU-Blaster Silent Clean.lnk = C:\Program Files\MRU-Blaster\mrublaster.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.pc-q.net
O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - http://akamai.downloadv3.com/binaries/IA/nethv32_EN_XP.cab
O16 - DPF: {88C51E90-8E9C-4C96-8A45-574D88B63FAF} - http://acceso.masminutos.com/laaplicacion.cab
O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} - http://dload.ipbill.com/del/loader.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab

[crunchie]

I have no idea what operating system, what IE version or what hijackthis version you are using as you have cut off the top of the log. Please include it in your next post.

Close all (browser) windows & rescan with hijackthis. When the scan is finished place a check in the box to the left of the following entries & click 'fix checked':

O2 - BHO: (no name) - {CA174FF9-A873-F9AD-4D62-A2FCAC3BFD4F} - C:\WINDOWS\d3lj32.dll

O4 - HKLM\..\RunOnce: [ntgw.exe] C:\WINDOWS\ntgw.exe
O4 - HKLM\..\RunOnce: [d3uc32.exe] C:\WINDOWS\system32\d3uc32.exe
O4 - HKLM\..\RunOnce: [sdkih.exe] C:\WINDOWS\system32\sdkih.exe
O4 - HKLM\..\RunOnce: [ipnn.exe] C:\WINDOWS\ipnn.exe
O4 - HKLM\..\RunOnce: [sysrn.exe] C:\WINDOWS\sysrn.exe
O4 - HKLM\..\RunOnce: [sysiw32.exe] C:\WINDOWS\system32\sysiw32.exe
O4 - HKLM\..\RunOnce: [ntvw.exe] C:\WINDOWS\ntvw.exe
O4 - HKLM\..\RunOnce: [ieit32.exe] C:\WINDOWS\system32\ieit32.exe
O4 - HKLM\..\RunOnce: [crss32.exe] C:\WINDOWS\crss32.exe
O4 - HKLM\..\RunOnce: [winci32.exe] C:\WINDOWS\system32\winci32.exe
O4 - HKLM\..\RunOnce: [ievw32.exe] C:\WINDOWS\system32\ievw32.exe
O4 - HKLM\..\RunOnce: [d3jv.exe] C:\WINDOWS\d3jv.exe
O4 - HKLM\..\RunOnce: [d3md.exe] C:\WINDOWS\d3md.exe
O4 - HKLM\..\RunOnce: [netsm32.exe] C:\WINDOWS\system32\netsm32.exe
O4 - HKLM\..\RunOnce: [mfcwo.exe] C:\WINDOWS\mfcwo.exe
O4 - HKLM\..\RunOnce: [javako32.exe] C:\WINDOWS\javako32.exe
O4 - HKLM\..\RunOnce: [systb.exe] C:\WINDOWS\systb.exe
O4 - HKLM\..\RunOnce: [addwk32.exe] C:\WINDOWS\system32\addwk32.exe
O4 - HKLM\..\RunOnce: [msio.exe] C:\WINDOWS\msio.exe
O4 - HKLM\..\RunOnce: [apprk.exe] C:\WINDOWS\apprk.exe

Download About:buster from http://malwarebytes.biz/AboutBuster.zip and unzip it to your desktop.

Download & instal Adaware from here
& update it before scanning.
In settings under 'scanning,' have it set to
'scan within archives,'
'scan active processes,'
'scan registry,'
'deepscan registry'
'scan my IE Favourites for banned URL's,'
'scan my host's file.'
In 'tweaks' under 'scanning engine' set it to 'unload recognised processes during scanning.'
Also in 'tweaks' under 'cleaning engine' set it to 'Automatically try to unregister objects prior to deletion' & 'let Windows remove files in use at next reboot.'

Click here for instructions on how to boot into safe mode.

Boot up in safe mode.

Run About:buster, click OK, Start, and OK again to start the scan. Let it scan and fix everything it finds.

Still in safe mode, do a full system scan with Adaware. When the scan is finished select *next* & place a check in the boxes to the left of what is found & click *next* again. Let it delete those entries.

Reboot your computer in normal mode. Post logs from hijackthis & about:buster please. If your hijackthis version is not 1.98 then please update it before posting.