spyware infecting my computer

Please read my directions again for where HijackThis is supposed to be running from. You have it running from the ZIP file:
C:\DOCUME~1\Will\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

You must follow directions! You will not get backups otherwise. Install it as requested and post a new HJT log.

 

You have an HSA hijack problem. Have you run HSremove and About:Buster?
Even if you have run them do the following:
- Make sure you have downloaded HSremove and About:Buster. Run About:Buster and click on the updates button to get the current reference file which is #21. Do not run a scan yet!!!
- print or save the below instructions locally because you must be physically disconnected (unplug cable) from the internet and do not run any browsers like IE or FireFox etc until I tell you to. Okay if you have printed these. Exit all browsers now and physically disconnect now!

- run About:Buster's scan now and click yes later when asked about doing a secondary scan. Save its log to ab1.log. When it finishes, immediately reboot in safe mode.
- run HSremove
- run About:Buster's scan and click yes later when asked about doing a secondary scan. Save its log to ab2.log. When it finishes, immediately normal mode.
- now (still no connection to the internet & no browsers should have been run) get a new HJT log and call it hjt1.log
- now connect to the internet and open one IE session and after it connects to what ever start page comes up. Exit the IE session.
- run another HJT scan and save the log to hjt2.log
- now come back here and post both AB logs and both HJT logs. That will require two messages.

 

Okay! First you must not run more than on antivirus application. Looks like you have McAfee and AVG. I would uninstall McAfee and keep AVG.

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\rvzxl.dll/sp.html#89328
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\rvzxl.dll/sp.html#89328
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\rvzxl.dll/sp.html#89328
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\rvzxl.dll/sp.html#89328
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\rvzxl.dll/sp.html#89328
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\rvzxl.dll/sp.html#89328
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {7FD1C6CE-B869-3B10-086D-CD732EE71233} - C:\WINDOWS\ntnb32.dll
O4 - HKLM\..\Run: [addya.exe] C:\WINDOWS\system32\addya.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: (HKLM)
O23 - Service: WLTRYSVC - Unknown - C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe (file missing)
O23 - Service: Network Security Service (NSS) - Unknown - C:\WINDOWS\crfa32.exe (file missing)

After clicking Fix, exit HJT.

Boot into safe mode and use Windows Explorer to delete:
C:\WINDOWS\rvzxl.dll
C:\WINDOWS\ntnb32.dll
C:\WINDOWS\system32\addya.exe

Let me know if you have any problems finding or deleting those files.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

 

Do you have each of these items set correctly?
Click Start and select Explore
Select the Tools menu and click Folder Options.
Select the View Tab.
- Under the Hidden files and folders heading select Show hidden files and folders.
- Uncheck the Hide extensions for known file types option.
- Uncheck the Hide protected operating system files (recommended) option.
Click Apply.
Click OK.

I need the HijackThis log!

 

You still have both McAfee and AVG installed. You must uninstall one. Running more than one antivirus applications can cause problems. They can fight against each other and they will slow your system down.

Other than that, your log looks clean.

But if AVG is popping up with downloader Agent.6.N, there may still be files remaining of your system. Do a full system scan with AVG in safe mode.

 

You're welcome. You should now check out: How to Protect yourself from malware!