Please help me kill off these pests

DeeDee555 · Cadet Joined: Jun 15, 2004 Posts: 1 Location: USA

I'm having so many pop-up windows that using my computer is giving me the urge to kill. Thank you for giving me your time and attention.

Here is my log:

Logfile of HijackThis v1.97.7
Scan saved at 10:06:08 AM, on 6/15/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\termsrv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Executive Software\DiskeeperServer\DKService.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINNT\system32\nutsrv4.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\WINNT\system32\tlntadgmn.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Java\j2re1.4.2_04\bin\javaw.exe
C:\Program Files\HySnapDX\hsdx.exe
C:\Program Files\Altova\xmlspy\XMLSPY.exe
C:\WINNT\System32\calc.exe
C:\WINNT\system32\wuauclt.exe
C:\Documents and Settings\dbentley.IDALICA\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
O2 - BHO: (no name) - {0000607D-D204-42C7-8E46-216055BF9918} - C:\WINNT\mxTarget.dll
O2 - BHO: (no name) - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINNT\systb.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0A71F290-64F0-4AD2-B0D8-B0F0B3213BBD} - C:\WINNT\system32\chic.dll
O2 - BHO: (no name) - {0DAF2C81-8586-49EC-9384-D9BBA92CE0A6} - C:\WINNT\system32\vlibrfc32.dll
O2 - BHO: (no name) - {210B445E-6E3A-4511-9C42-C072E994ABF4} - C:\WINNT\system32\siernonce.dll
O2 - BHO: (no name) - {261B9968-D169-47BC-BE52-E23A08068FCA} - C:\WINNT\system32\dbemssocn.dll
O2 - BHO: (no name) - {3A0D2BD5-91A9-4133-863B-CF9D3CB8A6D4} - C:\WINNT\system32\dmseerver.dll
O2 - BHO: (no name) - {3EB2F2ED-6509-4A38-B0F5-4E7E6F42EC2B} - C:\WINNT\system32\batmetewr.dll
O2 - BHO: (no name) - {3F18817A-FC16-48DE-8328-E78960766B3F} - C:\WINNT\system32\gxpkrsrc.dll
O2 - BHO: (no name) - {3FC867F1-C772-44C9-AB23-6DADA068A0B5} - C:\WINNT\system32\ksusekr.dll
O2 - BHO: (no name) - {4B5E397B-0F55-4653-98AC-31DD6CEF14D3} - C:\WINNT\system32\bdfssaetup.dll
O2 - BHO: (no name) - {54480661-A8FF-479B-A6CD-941053BD0D3C} - C:\WINNT\system32\ixrsso.dll
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O2 - BHO: (no name) - {5EBDF3B0-FEF0-465A-9C30-CE2664CDC9AD} - C:\WINNT\system32\iaesuserr.dll
O2 - BHO: (no name) - {76B5E123-B3BE-4F1A-9234-D10A9B4648A0} - C:\WINNT\system32\kmdcsvc.dll
O2 - BHO: (no name) - {79FE5DE2-18C5-472D-8D96-05E95833E570} - C:\WINNT\system32\kbmdsp.dll
O2 - BHO: (no name) - {7A294E7E-0243-4EDA-B5CB-96CC15F0B687} - C:\WINNT\system32\jdkhoopk.dll
O2 - BHO: (no name) - {9E5682C2-E4E5-4E0D-A176-25D41742F3A8} - C:\WINNT\system32\kbdnca.dll
O2 - BHO: (no name) - {A8A23A60-EAA5-4305-A096-D97722F925D9} - C:\WINNT\system32\dbgghelp.dll
O2 - BHO: (no name) - {AFC61B48-90D6-4AE7-A6B3-20231BF47A0C} - C:\WINNT\system32\kbwdit.dll
O2 - BHO: (no name) - {C2212FD1-6E90-4BF8-82F1-873D3F4C4B7C} - C:\WINNT\system32\dfcrgres.dll
O2 - BHO: (no name) - {C4F995E7-0E6E-4AF8-AE71-BE818FD44A4F} - C:\WINNT\system32\dirmap.dll
O2 - BHO: (no name) - {CC9A8AF5-5AC9-4AF4-B73E-E7D4411EB200} - C:\WINNT\system32\rdmdlgs.dll
O2 - BHO: (no name) - {CE7EF827-47CC-48EB-B570-C367F1E1277E} - C:\Documents and Settings\All Users\Application Data\x1ff\x1ff.dll
O2 - BHO: (no name) - {D319662B-D5BF-4538-ADF3-8D3E36362608} - C:\Documents and Settings\All Users\Application Data\X0ff\X0ff.dll
O2 - BHO: (no name) - {D4B7A65C-4154-4513-A58D-042E5212D255} - C:\WINNT\system32\cliodm.dll
O2 - BHO: (no name) - {D7465C9F-4C69-4F84-9C1B-89976826683C} - C:\WINNT\system32\dafrgui.dll
O2 - BHO: (no name) - {E89D7039-F4D8-4058-B042-5D50159844C4} - C:\WINNT\system32\bdfssetup.dll
O2 - BHO: (no name) - {E9F33686-DA09-4639-AF92-1634A8172152} - C:\WINNT\system32\kkbdic.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-D3FA-F27BA787AD2D} - (no file)
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [NuTCSetupEnviron] C:\PROGRA~1\RATIONAL\RATION~1\NUTCROOT\bin\ncoeenv.exe
O4 - HKLM\..\Run: [SoDA Startup] C:\Program Files\Rational\SoDAWord\Wizards\SodaStartup.exe StartUp
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe"
O4 - HKLM\..\Run: [tlntadgmn.exe] C:\WINNT\system32\tlntadgmn.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O16 - DPF: WebWorks Help 3.0 - https://firstbuy1.firstam.com/RW_EXTRA_...whelp3.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shoc...tor/sw.cab
O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50038/QDow.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/C...4177083333
O16 - DPF: {ABD45F35-2E4C-44C0-A075-6EF1DE75398E} (accel Class) - http://www.riversoftware.net/x0ff.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab
O16 - DPF: {D534A0F8-E0F2-4F11-8E53-345819B2451F} (Streaming VisualFX) - http://www.rmgdrs.com/update/x1ff.cab
O16 - DPF: {D702FBF4-EE60-11D0-BD5B-00A0C91F4635} (CFForm Runtime) - http://www.jeld-wen.com/CFIDE/classes/CFJava.cab
O16 - DPF: {EE2589EB-7FC8-44DB-A892-573F2C4B41E0} - http://pdf.forbes.com/forbesnews/trigge...Signed.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = corp.firstam.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{3D258539-0B5F-4ADF-8EDF-AA35F7693DB0}: Domain = corp.firstam.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{3D258539-0B5F-4ADF-8EDF-AA35F7693DB0}: NameServer = 172.17.22.11,172.17.22.12
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = corp.firstam.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = corp.firstam.com
O17 - HKLM\System\CS1\Services\Tcpip\..\{3D258539-0B5F-4ADF-8EDF-AA35F7693DB0}: Domain = corp.firstam.com
O17 - HKLM\System\CS1\Services\Tcpip\..\{3D258539-0B5F-4ADF-8EDF-AA35F7693DB0}: NameServer = 172.17.22.11,172.17.22.12
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = corp.firstam.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = corp.firstam.com


	Home ˇ Topics ˇ Submit News ˇ Top 10 This entire site, Cops Themes, and Computer Cops are Š 2002 - 2004 Computer Cops, LLC. All rights reserved. You can syndicate our news using the file RSS 0.91, ultramode.txt, or RSS 1.0. Acceptable Use Policy. Use signifies your agreement. Engine Copyright Š 2002 by PHP-Nuke, GNU/GPL Licensed. ICRA Member. Paul Laudanski, Member of Computer Cops, LLC Server Load: 749 pages served in previous 5 minutes. Page Rendered: 0.728 seconds.