[michaely]

I get random popups containing ads. When I run spybot SD I get 3 possible threats. I remove them but they come back. 2 of them is Common hijacker to a ip=69.20.16.183 and the last one is IgetNet, ieautosearch also to the same IP
I have a log from Hijack this. If I try to remove the 3 01-posts in the hijackscan they also come back in a few seconds. Can anyone help?

Logfile of HijackThis v1.98.2
Scan saved at 16:15:48, on 2004-11-30
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\CA\Common\Alert\ALERT.EXE
C:\Program\Cisco Systems\VPN Client\cvpnd.exe
C:\Program\Compaq\COMPAQ~1\hibserv.exe
C:\Program\CA\eTrust\InoculateIT\InoRpc.exe
C:\Program\CA\eTrust\InoculateIT\InoRT.exe
C:\Program\CA\eTrust\InoculateIT\InoTask.exe
C:\Program\Delade filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nutsrv4.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Program\Compaq\EAB\EabServr.exe
C:\Program\CA\eTrust\InoculateIT\realmon.exe
C:\Program\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\wuauclt.exe
C:\temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.se
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.msn.se
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dovlx1.dom.se/intraweb/go
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program\Compaq\EAB\EabServr.exe /Start
O4 - HKLM\..\Run: [Realtime Monitor] C:\Program\CA\eTrust\InoculateIT\realmon.exe
O4 - HKLM\..\Run: [NuTCSetupEnviron] C:\Program\Rational\Rational Test\nutcroot\bin\ncoeenv.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{08DB9CFC-4B41-45A5-9A87-6B1637BF986B}: NameServer = 159.190.1.72,159.190.1.8,164.9.196.5,169.9.196.55
O17 - HKLM\System\CS1\Services\Tcpip\..\{08DB9CFC-4B41-45A5-9A87-6B1637BF986B}: NameServer = 159.190.1.72,159.190.1.8,164.9.196.5,169.9.196.55
O17 - HKLM\System\CS2\Services\Tcpip\..\{08DB9CFC-4B41-45A5-9A87-6B1637BF986B}: NameServer = 159.190.1.72,159.190.1.8,164.9.196.5,169.9.196.55

[tg1911]

Put HijackThis in a Permanent folder:
Click My Computer / C: / File / New / Folder / name the folder; HijackThis
Put HijackThis.exe, in this folder.
This is a mandatory step, for the backup and restore functions, of HijackThis, to be able to work.

Read the pinned post in the Security forum, here

Then, run a log, and post it in the HJT forum, here. Do not, fix anything, yet.
A member, of the HJT Team, will help you out.
Please, be patient, these people are volunteers. They will help you out, as soon as possible.

[michaely]

Hi again
Started a new from a restartpoint day before yesterday
Installed and ran the new updated adaware which found several problems compared to my old version.
that seems to have made the trick
Thanks!
Michael

[Dragon]

hi Michaely,
could you please post a new hijack this log, I wan to tcompare it to your old one to make sure everything is fixed.
Thanks