hijakthis for popups that wont go away

when i open the program back up it shows inficted objects found any way to post them

 

is this it
---------------------------------------------------------
ewido anti-malware - Process report
---------------------------------------------------------

+ Created on: 10:28:00 AM, 1/2/2006
+ Report-Checksum: 87D24A7F

0: System Process
4: System Process
124: C:\Program Files\Internet Explorer\iexplore.exe
488: C:\WINDOWS\Explorer.EXE
536: C:\WINDOWS\system32\wuauclt.exe
552: \SystemRoot\System32\smss.exe
572: C:\WINDOWS\System32\alg.exe
604: \??\C:\WINDOWS\system32\csrss.exe
628: \??\C:\WINDOWS\system32\winlogon.exe
672: C:\WINDOWS\system32\services.exe
684: C:\WINDOWS\system32\lsass.exe
836: C:\WINDOWS\system32\svchost.exe
932: C:\WINDOWS\system32\svchost.exe
1036: C:\WINDOWS\System32\svchost.exe
1112: C:\WINDOWS\System32\svchost.exe
1284: C:\WINDOWS\System32\svchost.exe
1408: C:\WINDOWS\system32\spoolsv.exe
1528: C:\Program Files\ewido anti-malware\ewidoctrl.exe
1544: C:\Program Files\ewido anti-malware\ewidoguard.exe
1596: c:\Program Files\Norton AntiVirus\navapsvc.exe
1648: C:\Program Files\Softex\OmniPass\Omniserv.exe
1708: C:\WINDOWS\System32\svchost.exe
1768: C:\Program Files\ewido anti-malware\SecuritySuite.exe
1792: C:\WINDOWS\system32\wdfmgr.exe
1996: C:\Program Files\Softex\OmniPass\OPXPApp.exe

 

I don't think that ewido will remove anything related to Nero. What program tells that infected objects found?

EDIT: No, it isn't. Did you click "Save report" after the scan?

 

anti malware ewido

 

Ok. Do you mean that you have opened ewido's backup-folder? That's normal because ewido creates a backup of every file it deletes into that folder.

 

no i just opened back up the program

 

Ok, ewido just counts every infected object it has removed No worry needed. Send a fresh HjT-log, please.

 

Logfile of HijackThis v1.99.1
Scan saved at 10:51:47 AM, on 1/2/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\msiexec.exe
C:\Documents and Settings\Owner\My Documents\my music\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\companion\Installs\cpn\yt.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O4 - Global Startup: Desktop 16.lnk = C:\Program Files\Common Files\Desktop 16\TrueWeather.exe
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1128862697468
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe

 

Your log is clean Still having problems? I highly recommend to install another firewall.

 

which free firewall do you recomend .and do i have to delete windows firewall or just turn off tried sunbelt but it turned the screen blue and was doing this dump thing i deleted it

 

i do use frostwire alot and leave windows firewall leave it run ??????????????

 

Try ZoneAlarm or Sygate then. You can't delete windows firewall, only turn it off

 

Sygate is it free ??????? and will it help i wonder why windows firewall is no good can you give me link for Sygate

 

i just ran spybot search and destroy found 3 items iwonder why??????????

 

you there ??????????

 

Here -> http://smb.sygate.com/products/spf_standard.htm .Well, spybot can find some that ewido won't, quite unprobable though.

 

just did ewido and removed this


---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 11:20:50 AM, 1/2/2006
+ Report-Checksum: 739E527F

+ Scan result:

C:\WINDOWS\ime\shared\ACDSee 9.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Adobe Photoshop 9 fuââ.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Ahead Nero 7.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Kaspersky Antivirus 5.0 -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\KAV 5.0 -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Matrix 3 Revolution English Subtitles.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Microsoft Office 2003 Crack, Working!.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Microsoft Office XP working Crack, Keygen.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Microsoft Windows XP, WinXP Crack, working Keygen.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Opera 8 New!.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Porno pics arhive, xxx.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Porno Screensaver.scr -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Porno, sex, oral, anal cool, awesome!!.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Serials.txt.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\WinAmp 5 Pro Keygen Crack Update.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\WinAmp 6 New!.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Windown Longhorn Beta Leak.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Windows Sourcecode update.doc.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\XXX hardcore images.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\jdibyhtA.exe -> Hijacker.VB.ij : Cleaned with backup
C:\WINDOWS\offun.exe -> Downloader.VB.nw : Cleaned with backup
C:\WINDOWS\system32\1E262727232325.exe -> Trojan.VB.aft : Cleaned with backup
C:\WINDOWS\system32\399.exe -> Dropper.Agent.xw : Cleaned with backup
C:\WINDOWS\system32\aupdate.exe -> Downloader.Adload.k : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\ACDSee 9.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Adobe Photoshop 9 fuââ.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Ahead Nero 7.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Kaspersky Antivirus 5.0 -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\KAV 5.0 -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Matrix 3 Revolution English Subtitles.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Microsoft Office 2003 Crack, Working!.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Microsoft Office XP working Crack, Keygen.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Microsoft Windows XP, WinXP Crack, working Keygen.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Opera 8 New!.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Porno pics arhive, xxx.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Porno Screensaver.scr -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Porno, sex, oral, anal cool, awesome!!.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Serials.txt.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\WinAmp 5 Pro Keygen Crack Update.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\WinAmp 6 New!.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Windown Longhorn Beta Leak.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Windows Sourcecode update.doc.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\XXX hardcore images.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\wingo.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\wingo.exeopen -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\wingo.exeopenopen -> Worm.Bagle.au : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@ad.yieldmanager[1].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@adopt.specificclick[2].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@ads.pointroll[2].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@paypopup[1].txt -> Spyware.Cookie.Paypopup : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@trafficmp[2].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup


::Report End

 

????????????

 

you there man

 

did it again and found this



---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 11:32:03 AM, 1/2/2006
+ Report-Checksum: 5A299E0

+ Scan result:

C:\Documents and Settings\Owner\Cookies\owner@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup


::Report End


this double click is what is coming up in spybot seach and destroy