[BlueStreek]

using firefox but getting IE popups please help. More specifically I have 2 problems I have to Iexplore.exe processe constantly open and the wont stop and second every time I play a game I get popups for Ie please help here is my hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 3:10:54 PM, on 11/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Steam\Steam.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Administrator\Desktop\Apps\HS\HijackThis.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RunDLL32] C:\WINDOWS\RunDLL32.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [RunDLL32] C:\WINDOWS\RunDLL32.exe
O4 - HKCU\..\Run: [Bat Drive] C:\DOCUME~1\ADMINI~1\APPLIC~1\IDLEBU~1\Win Close Math.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

please help thanks.

[Advertisements]

Hi

Please download ComboFix and save it to your desktop.
Double click combofix.exe and follow the prompts.
When it's done running it will produce a log for you. Please post that log in your next reply.

Important Note - Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

[loophole]

Hi

Please download ComboFix and save it to your desktop.
Double click combofix.exe and follow the prompts.
When it's done running it will produce a log for you. Please post that log in your next reply.

Important Note - Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

[BlueStreek]

here is the log u requested thanks
Administrator - 06-11-11 17:45:45.84 Service Pack 2
ComboFix 06.11.9 - Running from: "C:\Documents and Settings\Administrator\Desktop"

((((((((((((((((((((((((((((((( Files Created from 2006-10-11 to 2006-11-11 ))))))))))))))))))))))))))))))))))


2006-11-08 09:55 314,368 --a------ C:\WINDOWS\uninst.exe
2006-10-31 12:15 86,016 --a------ C:\WINDOWS\system32\OpenAL32.dll
2006-10-31 12:15 409,600 --a------ C:\WINDOWS\system32\wrap_oal.dll
2006-10-31 08:23 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys
2006-10-30 19:29 127,208 --a------ C:\WINDOWS\system32\mucltui.dll
2006-10-22 14:10 172,032 --a------ C:\WINDOWS\system32\cncs32.dll
2006-10-20 10:33 271,360 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2006-10-20 10:33 18,048 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2006-10-12 11:37 745,984 --a------ C:\WINDOWS\system32\ir50_32.dll
2006-10-12 11:37 56,320 --------- C:\WINDOWS\system32\iyvu9_32.dll
2006-10-12 11:37 202,240 --a------ C:\WINDOWS\system32\ir32_32.dll
2006-10-12 11:37 136,704 --a------ C:\WINDOWS\system32\iacenc.dll


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-11-11 17:43 -------- d-------- C:\Program Files\Mozilla Firefox
2006-11-11 15:24 -------- d-------- C:\Program Files\Morpheus
2006-11-11 13:58 -------- d-------- C:\Program Files\Steam
2006-11-11 12:21 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-11-11 12:21 -------- d-------- C:\Program Files\dominions3
2006-11-10 23:21 -------- d-------- C:\Program Files\ZC2.10
2006-11-10 10:55 -------- d-------- C:\Program Files\Neon Wars
2006-11-09 12:56 -------- d-------- C:\Program Files\AGEIA Technologies
2006-11-09 12:55 -------- d-------- C:\Program Files\Common Files\Wise Installation Wizard
2006-11-09 12:55 -------- d-------- C:\Program Files\Common Files
2006-11-08 12:05 -------- d-------- C:\Program Files\Jet Jumper
2006-11-08 12:05 -------- d-------- C:\Program Files\Astral Masters
2006-11-08 10:38 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Help
2006-11-08 10:13 -------- d-------- C:\Program Files\LucasArts
2006-11-06 13:34 -------- d-------- C:\Program Files\War Chess
2006-11-06 13:34 -------- d-------- C:\Program Files\Sewer Run
2006-11-06 13:34 -------- d-------- C:\Program Files\Risk II
2006-11-06 13:34 -------- d-------- C:\Program Files\Project Xenoclone
2006-11-06 13:34 -------- d-------- C:\Program Files\Gish
2006-11-06 13:34 -------- d-------- C:\Program Files\CoolCube TV
2006-11-06 13:34 -------- d-------- C:\Program Files\Avast
2006-11-06 13:32 -------- d-------- C:\Program Files\CleanUp!
2006-11-06 11:22 -------- d-------- C:\Program Files\Lavasoft
2006-11-05 08:19 -------- d-------- C:\Program Files\Electronic Arts
2006-11-04 17:51 -------- d-------- C:\Program Files\Travelogue 360 Paris
2006-11-03 21:15 -------- d-------- C:\Program Files\Ubisoft
2006-11-03 21:14 -------- d-------- C:\Program Files\asc
2006-11-03 21:07 -------- d-------- C:\Documents and Settings\Administrator\Application Data\SpieleEntwicklungsKombinat
2006-11-02 17:18 -------- d-------- C:\Program Files\Mystery Solitaire - Secret Island
2006-11-01 13:03 -------- d-------- C:\Program Files\Word Cross
2006-10-31 12:18 -------- d-------- C:\Program Files\Gumboy Crazy Adventures
2006-10-31 12:15 -------- d-------- C:\Program Files\OpenAL
2006-10-31 11:05 -------- d-------- C:\Program Files\Pat Sajak`s Trivia Gems
2006-10-31 03:13 -------- d-------- C:\Program Files\Internet Explorer
2006-10-31 03:00 -------- d-------- C:\Program Files\MSXML 4.0
2006-10-30 19:42 -------- d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2006-10-28 12:38 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Activision
2006-10-28 12:16 -------- d-------- C:\Program Files\Activision
2006-10-26 22:31 -------- d-------- C:\Program Files\Virus 3
2006-10-26 02:02 -------- d-------- C:\Program Files\Championship Chess
2006-10-25 16:58 -------- d-------- C:\Program Files\PacSteam
2006-10-25 15:13 -------- d-------- C:\Program Files\Aspyr Media, Inc
2006-10-24 23:11 -------- d-------- C:\Program Files\PacSteam 04.09.06
2006-10-24 23:10 -------- d-------- C:\Program Files\Monte Cristo
2006-10-24 23:03 -------- d-------- C:\Program Files\GameHouse
2006-10-24 22:33 -------- d-------- C:\Program Files\PartyGaming
2006-10-24 20:40 -------- d-------- C:\Program Files\Newspaper Puzzle Challenge
2006-10-22 22:33 -------- d-------- C:\Program Files\JetacerGames
2006-10-20 13:17 -------- d-------- C:\Program Files\FlashFXP
2006-10-20 11:49 -------- d-------- C:\Program Files\Gothic III
2006-10-20 10:33 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-10-19 15:59 -------- d-------- C:\Program Files\iWin.com
2006-10-18 21:47 -------- d-------- C:\Program Files\NetPumper
2006-10-18 20:58 -------- d-------- C:\Documents and Settings\Administrator\Application Data\NetPumper
2006-10-18 20:58 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Idle burn bash
2006-10-18 20:57 -------- d-------- C:\Program Files\Idle burn bash
2006-10-18 20:57 -------- d-------- C:\Program Files\Anti-Leech
2006-10-18 18:15 -------- d-------- C:\Program Files\Putt Nutz DX
2006-10-18 17:58 -------- d-------- C:\Program Files\MultiplayUNO
2006-10-17 07:58 -------- d-------- C:\Documents and Settings\Administrator\Application Data\DivX
2006-10-16 19:41 -------- d-------- C:\Program Files\Heretic Kingdoms - The Inquisition
2006-10-16 17:24 -------- d-------- C:\Program Files\EA SPORTS
2006-10-16 17:03 -------- d-------- C:\Program Files\Project 3 Interactive
2006-10-13 17:27 -------- d-------- C:\Program Files\Trymedia
2006-10-13 11:18 -------- d-------- C:\Program Files\Mirror Mixup
2006-10-13 11:18 -------- d-------- C:\Program Files\Explore the World
2006-10-12 11:37 -------- d-------- C:\Program Files\Ligos
2006-10-12 10:06 -------- d-------- C:\Program Files\DivX
2006-10-09 22:30 1248 --a------ C:\Documents and Settings\Administrator\Application Data\enigmarc.lua2
2006-10-09 10:35 -------- d-------- C:\Program Files\Gorilla 2
2006-10-08 22:05 -------- d-------- C:\Program Files\Cenega
2006-10-07 23:24 -------- d-------- C:\Program Files\Radical Games
2006-10-07 18:25 -------- d-------- C:\Program Files\Billy Blade and the Temple of Time
2006-10-07 17:36 -------- d-------- C:\Program Files\Numericon
2006-10-04 15:14 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Adobe
2006-10-04 15:10 -------- d-------- C:\Program Files\Adobe
2006-10-04 15:09 -------- d-------- C:\Program Files\Common Files\Adobe
2006-10-04 15:07 -------- d-------- C:\Program Files\Common Files\Adobe Systems Shared
2006-10-04 11:46 -------- d-------- C:\Program Files\JustFreeGames.com
2006-10-03 19:09 -------- d-------- C:\Program Files\Macromedia
2006-10-03 19:09 -------- d-------- C:\Program Files\Common Files\Macromedia
2006-10-03 18:59 -------- d-------- C:\Program Files\Virtual Villagers
2006-10-03 18:59 -------- d-------- C:\Program Files\Jig Art Quest
2006-10-03 18:58 -------- d-------- C:\Program Files\Devastation Zone Troopers
2006-10-03 18:58 -------- d-------- C:\Program Files\Alawar
2006-10-03 18:55 -------- d-------- C:\Program Files\Activision Value
2006-10-02 22:08 -------- d-------- C:\Program Files\Cipher8
2006-10-02 22:05 -------- d-------- C:\Program Files\Anacrostics
2006-10-02 22:04 286720 --------- C:\WINDOWS\Setup1.exe
2006-10-02 19:45 -------- d-------- C:\Program Files\Diamondo
2006-10-02 14:04 806912 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2006-10-02 14:04 806912 --a------ C:\WINDOWS\system32\divx_xx07.dll
2006-10-02 14:04 790528 --a------ C:\WINDOWS\system32\divx_xx11.dll
2006-10-02 14:04 635486 --a------ C:\WINDOWS\system32\DivX.dll
2006-10-01 22:23 -------- d-------- C:\Program Files\NAMCO BANDAI Games
2006-10-01 12:39 73216 --------- C:\WINDOWS\ST6UNST.EXE
2006-09-30 12:59 -------- d-------- C:\Program Files\CAPCOM
2006-09-28 14:55 53248 --a------ C:\WINDOWS\system32\PhysXLoader.dll
2006-09-27 19:37 -------- d-------- C:\Program Files\Boxed In
2006-09-27 11:12 -------- d-------- C:\Program Files\Sunflowers
2006-09-26 20:01 -------- d-------- C:\Program Files\Logitech
2006-09-26 20:01 -------- d-------- C:\Program Files\Common Files\Logitech
2006-09-26 18:19 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Registry Booster
2006-09-26 14:01 45056 -ra------ C:\WINDOWS\system32\AgCPanelJapanese.dll
2006-09-26 11:25 -------- d-------- C:\Program Files\Common Files\InstallShield
2006-09-25 10:45 666240 --a------ C:\WINDOWS\system32\aswBoot.exe
2006-09-25 10:40 87424 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2006-09-25 10:40 85952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2006-09-25 10:39 36176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2006-09-25 10:39 16352 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2006-09-25 10:37 90112 --a------ C:\WINDOWS\system32\AVASTSS.scr
2006-09-25 10:37 24560 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2006-09-25 04:00 -------- d-------- C:\Program Files\The Guild 2
2006-09-24 02:11 -------- d-------- C:\Program Files\TopWare
2006-09-23 14:51 -------- d-------- C:\Program Files\Uniblue
2006-09-21 22:36 -------- d-------- C:\Program Files\CureROM
2006-09-21 21:15 -------- d-------- C:\Program Files\Eidos
2006-09-20 10:40 -------- dr-h----- C:\Documents and Settings\Administrator\Application Data\SecuROM
2006-09-18 19:19 -------- d-------- C:\Program Files\AutoPatcher
2006-09-15 17:42 -------- d-------- C:\Program Files\WarRock
2006-09-14 11:54 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Electronic Arts
2006-09-13 00:01 1084416 --a------ C:\WINDOWS\system32\msxml3.dll
2006-09-12 19:17 34308 --a------ C:\WINDOWS\system32\BASSMOD.dll
2006-09-12 18:46 -------- d-------- C:\Documents and Settings\Administrator\Application Data\Backyard Baseball 2007
2006-09-12 17:51 1245184 --a------ C:\WINDOWS\system32\msxml4.dll
2006-09-11 13:09 -------- d-------- C:\Documents and Settings\Administrator\Application Data\FlashFXP
2006-09-08 09:01 45056 -ra------ C:\WINDOWS\system32\AgCPanelTraditionalChinese.dll
2006-09-08 09:01 45056 -ra------ C:\WINDOWS\system32\AgCPanelSwedish.dll
2006-09-08 09:01 45056 -ra------ C:\WINDOWS\system32\AgCPanelSpanish.dll
2006-09-08 09:01 45056 -ra------ C:\WINDOWS\system32\AgCPanelSimplifiedChinese.dll
2006-09-08 09:01 45056 -ra------ C:\WINDOWS\system32\AgCPanelPortugese.dll
2006-09-08 09:01 45056 -ra------ C:\WINDOWS\system32\AgCPanelKorean.dll
2006-09-08 09:01 45056 -ra------ C:\WINDOWS\system32\AgCPanelGerman.dll
2006-09-08 09:01 45056 -ra------ C:\WINDOWS\system32\AgCPanelFrench.dll
2006-09-05 17:38 14 --a------ C:\WINDOWS\system32\systeminfo.dll
2006-09-01 17:55 737280 --a------ C:\WINDOWS\iun6002.exe
2006-09-01 17:35 158669 --a------ C:\WINDOWS\Windows Uninstaller.exe
2006-09-01 12:08 1334032 --a------ C:\WINDOWS\system32\msxml6.dll
2006-08-31 17:09 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2006-08-25 21:36 260608 --a------ C:\WINDOWS\steampatcherv2.exe
2006-08-25 21:36 1264832 --a------ C:\WINDOWS\RunDLL32.exe
2006-08-25 21:36 1264832 --a------ C:\WINDOWS\30004.exe
2006-08-25 21:33 81920 --a------ C:\WINDOWS\loader.exe
2006-08-25 21:33 69632 --a------ C:\WINDOWS\Vac 2 Disabler.dll
2006-08-25 10:45 617472 --a------ C:\WINDOWS\system32\comctl32.dll
2006-08-21 07:21 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 04:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-08-19 09:33 0 -rahs---- C:\MSDOS.SYS
2006-08-19 09:33 0 -rahs---- C:\IO.SYS
2006-08-19 09:33 0 --a------ C:\CONFIG.SYS
2006-08-19 09:33 0 --a------ C:\AUTOEXEC.BAT
2006-08-19 04:43 62 --ahs---- C:\Documents and Settings\Administrator\Application Data\desktop.ini
2006-08-16 16:55 208896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2006-08-16 16:55 208896 --a------ C:\WINDOWS\system32\nvudisp.exe
2006-08-16 06:58 100352 --a------ C:\WINDOWS\system32\6to4svc.dll
2006-08-11 20:45 888832 --a------ C:\WINDOWS\system32\nvmobls.dll
2006-08-11 20:45 5611520 --a------ C:\WINDOWS\system32\nvdisps.dll
2006-08-11 20:45 5251072 --a------ C:\WINDOWS\system32\nvdispsr.dll
2006-08-11 20:45 458752 --a------ C:\WINDOWS\system32\nvmccssr.dll
2006-08-11 20:45 45056 --a------ C:\WINDOWS\system32\nvmccsrs.dll
2006-08-11 20:45 3039232 --a------ C:\WINDOWS\system32\nvgames.dll
2006-08-11 20:45 2953216 --a------ C:\WINDOWS\system32\nvvitvsr.dll
2006-08-11 20:45 2928640 --a------ C:\WINDOWS\system32\nvgamesr.dll
2006-08-11 20:45 2904064 --a------ C:\WINDOWS\system32\nvvitvs.dll
2006-08-11 20:45 2859008 --a------ C:\WINDOWS\system32\nvmoblsr.dll
2006-08-11 20:45 188416 --a------ C:\WINDOWS\system32\nvmccss.dll
2006-08-11 20:45 1732608 --a------ C:\WINDOWS\system32\nvwssr.dll
2006-08-11 20:45 1236992 --a------ C:\WINDOWS\system32\nvwss.dll
2006-08-11 20:44 147456 --a------ C:\WINDOWS\system32\nvcolor.exe
2006-08-11 20:43 794624 --a------ C:\WINDOWS\system32\nvcplui.exe
2006-08-11 20:43 466944 --a------ C:\WINDOWS\system32\nvshell.dll
2006-08-11 20:43 442368 --a------ C:\WINDOWS\system32\nvappbar.exe
2006-08-11 20:43 425984 --a------ C:\WINDOWS\system32\keystone.exe
2006-08-11 20:43 311296 --a------ C:\WINDOWS\system32\nvexpbar.dll
2006-08-11 20:43 1662976 --a------ C:\WINDOWS\system32\nvwdmcpl.dll
2006-08-11 20:43 1519616 --a------ C:\WINDOWS\system32\nwiz.exe
2006-08-11 20:43 1470464 --a------ C:\WINDOWS\system32\nview.dll
2006-08-11 20:43 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe
2006-08-11 20:43 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll
2006-08-11 20:43 1011712 --a------ C:\WINDOWS\system32\nvcpluir.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"RunDLL32"="C:\\WINDOWS\\RunDLL32.exe"
"Bat Drive"="C:\\DOCUME~1\\ADMINI~1\\APPLIC~1\\IDLEBU~1\\Win Close Math.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"RunDLL32"="C:\\WINDOWS\\RunDLL32.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000004

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,de,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=dword:40000004
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,23,00,00,00,7c,00,00,00,72,00,\
00,00,01,00,00,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bat Drive]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Win Close Math"
"hkey"="HKCU"
"command"="C:\\DOCUME~1\\ADMINI~1\\APPLIC~1\\IDLEBU~1\\Win Close Math.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NvCpl"
"hkey"="HKLM"
"command"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RunDLL32]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RunDLL32"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\RunDLL32.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Start WingMan Profiler]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=""
"hkey"="HKCU"
"command"=""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="realsched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue Registry Booster]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RegistryBooster"
"hkey"="HKCU"
"command"="C:\\Program Files\\Uniblue\\Registry Booster\\RegistryBooster.exe /S"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\A919545A91FECCBE.job

Completion time: 06-11-11 17:46:49.76
C:\ComboFix.txt ... 06-11-11 17:46

[loophole]

Hi

Please run a scan with HijackThis and check the following lines for removal:


O4 - HKLM\..\Run: [RunDLL32] C:\WINDOWS\RunDLL32.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [RunDLL32] C:\WINDOWS\RunDLL32.exe
O4 - HKCU\..\Run: [Bat Drive] C:\DOCUME~1\ADMINI~1\APPLIC~1\IDLEBU~1\Win Close Math.exe

Now close ALL other open windows except for HijackThis and hit FIX CHECKED. Exit HijackThis.


Please open Notepad, and copy/paste the code in the white box below into a new text file. Save it as "delete.bat" WITH THE QUOTES and save it on your Desktop.

@echo off
attrib -s -r -h "C:\DOCUME~1\ADMINI~1\APPLIC~1\IDLEBU~1\*.*"
rd /q /s "C:\DOCUME~1\ADMINI~1\APPLIC~1\IDLEBU~1"
attrib -s -r -h "C:\Documents and Settings\Administrator\Application Data\Idle burn bash\*.*"
rd /q /s "C:\Documents and Settings\Administrator\Application Data\Idle burn bash"
attrib -s -r -h "C:\Program Files\Idle burn bash\*.*"
rd /q /s "C:\Program Files\Idle burn bash"
attrib -s -r -h "C:\WINDOWS\tasks\A919545A91FECCBE.job"
del /q "C:\WINDOWS\tasks\A919545A91FECCBE.job"
attrib -s -r -h "C:\WINDOWS\iun6002.exe"
del /q "C:\WINDOWS\iun6002.exe"
attrib -s -r -h "C:\WINDOWS\loader.exe"
del /q "C:\WINDOWS\loader.exe"
attrib -s -r -h "C:\WINDOWS\30004.exe"
del /q "C:\WINDOWS\30004.exe"
attrib -s -r -h "C:\WINDOWS\RunDLL32.exe"
del /q "C:\WINDOWS\RunDLL32.exe"
quit

after saving as instructed above, please close notepad. You will now have a file on your desktop called delete.bat. Dont do anything with it yet

Reboot your computer in Safe Mode.

• If the computer is running, shut down Windows, and then turn off the power.
• Wait 30 seconds, and then turn the computer on.
• Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
• Ensure that the Safe Mode option is selected.
• Press Enter. The computer then begins to start in Safe mode.
• Login on your usual account.

Please double click the delete.bat file we created and let it run, it will only take a second or two

Clean out your Temporary Internet files. Proceed as follows:

• Quit Internet Explorer and quit any instances of Windows Explorer.
• Click Start, click Control Panel, and then double-click Internet Options.
• On the General tab, click Delete Files under Temporary Internet Files.
• In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
• On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
• Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
• Click OK.

Reboot and post a new hijack log and let me know how the system is behaving

Thanks

[BlueStreek]

Heres the log as you requested and so far no pop ups thanks

Logfile of HijackThis v1.99.1
Scan saved at 1:26:16 AM, on 11/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Administrator\Desktop\Apps\HS\HijackThis.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Bat Drive] C:\DOCUME~1\ADMINI~1\APPLIC~1\IDLEBU~1\Win Close Math.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[loophole]

Hi< good to hear

I think you missed this one with the fixes for Hijack

O4 - HKCU\..\Run: [Bat Drive] C:\DOCUME~1\ADMINI~1\APPLIC~1\IDLEBU~1\Win Close Math.exe

Please go HERE to run Panda's ActiveScan

• Once you are on the Panda site click the Scan your PC button
• A new window will open...click the Check Now button
• Enter your Country
• Enter your State/Province
• Enter your e-mail address and click send
• Select either Home User or Company
• Click the big Scan Now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
• When download is complete, click on My Computer to start the scan
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report along with a new hijackthis log.