HJT Log

[jholland1964]

Whew!
Ok, first some questions, is this your internet provider?

qld.bigpond.net.au

Did you run HiJackThis before or after the scans with Spybot and AdAware?
The reason I ask is because the HJT log shows this in Running Processes;

C:\WINDOWS\system32\ishost.exe

While the Spybot scan shows it as fixed.

Did you have AdAwareSE fix everything found?

I may be trying a shortcut but let's see how much of this works;
Download CCleaner and install it.

Update both AdWareSE and Spybot.
Reboot to SAFE MODE.

Run CCleaner and run ONLY the default scan (Windows Tab). Do Not “Scan For Issues”
Have it remove everything it finds.

Next run Spybot. Full system Scan. Remove everything found.
Run AdAwareSE, remove everything found.
Run your AVG, full system scan and remove everything found.

Reboot to normal mode.
Run HJT and place checkmarks next to all of the following;
O3 - Toolbar: ToolBar888 - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\Program Files\Common Files\{30B10014-095F-3081-0124-03022503003d}\MyToolBar.dll

O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvtag.dll,startup
O4 - HKLM\..\Run: [ravdhpf.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ravdhpf.dll,plpcgc
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [wyzgdkk.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\wyzgdkk.dll,zbjnhsb
O4 - HKLM\..\Run: [zxjquyl.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\zxjquyl.dll,qejmsx

O16 - DPF: {11818680-FCF6-11D0-9808-0800092A4865} (Adobe Form Control) - http://www.ato.gov.au/formflow/codebase/FormCtl.cab
O16 - DPF: {224F7DEA-B7C1-11D3-AB40-00902712A5C9} (PLSAddin Class) - http://www.ato.gov.au/formflow/codebase/plsspeller.cab
O16 - DPF: {CDDCFBB3-4D93-11D2-B1A9-00A0C9B742BE} (Adobe Script Object) - http://www.ato.gov.au/formflow/codeb...riptobject.cab
O16 - DPF: {EF2FB80F-0975-408E-A871-B00CC863478A} (Adobe Soft Font Installer) - http://www.ato.gov.au/formflow/codeb...tinstaller.cab

Now if qld.bigpond.net.au is NOT your internet provider then you will need to place checkmarks here, BUT if it IS your internet provider then ignore these;
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CS1\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = qld.bigpond.net.au

Once you have placed all the checkmarks then click the FIX button. Exit HJT.
Then run a new HJT scan and post the log here.