First Time Posting A Logfile Need Some Help

I keep losing my net connection, it is dial up. I am wondering if any of this could be the cause.

saved at 6:52:09 PM, on 2/20/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\Program Files\CallWave\IAM.exe
C:\Program Files\Juno\bin\juno.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Directory 7 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SU Toolbar Helper - {D44BBB61-E17F-4AE6-A502-8D7E0B29E616} - C:\WINDOWS\DOWNLO~1\STUMBL~1.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKCU\..\Run: [Instant Access] rundll32.exe EGDACCESS_1057.dll,InstantAccess
O4 - Global Startup: Internet Answering Machine.lnk = C:\Program Files\CallWave\IAM.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: JT's Blocks - http://download.games.yahoo.com/games/clients/y/blt1_x.cab
O16 - DPF: Yahoo! Dice - http://download.games.yahoo.com/games/clients/y/dct4_x.cab
O16 - DPF: Yahoo! Towers 2.0 - http://download.games.yahoo.com/games/clients/y/ywt0_x.cab
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popc…aploader_v5.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6513734A-62BE-4882-8D1C-07AA279FB79A}: NameServer = 64.136.20.133 64.136.28.133
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe

Hello SciTeach4u, Welcome to TomCoyote forum. If you are still looking for help, please follow these directions.

I keep losing my net connection, it is dial up. I am wondering if any of this could be the cause.

1) You have a premium rate dialer onboard, while I can't be 100% sure this is the reason, there is a very good chance that the efforts it makes to dial out could cause your connection to fail. I am also removing your Downloaded Program Files to make sure nothing in those is responsible. If you return to the site you will be prompted to download those cab files again.

2) You have cut off the first line of the log header, please make sure you are running version 1.99.1 and if not update it like this: "Config"=>"Misc Tools"=>"Check for updates online" before posting the next log.

3) You are running HijackThis.exe out of a zip file from a temporary directory. See the last line in running processes. You should have received this message: http://russelltexas.com/malware/images/unsafefolder.gif
If you wish to run HJT.exe from Docs and Settings, return there and RIGHT click on a blank spot and create a NEW FOLDER. Call it HJT then move HJT.exe into that folder. This is where it will store backups for safety and logs. Delete anything left outside of that folder like the zip file. Once this is done then move to step four.

4) Scan with HijackThis and put a check in front of each of these line items:

O4 - HKCU\..\Run: [Instant Access] rundll32.exe EGDACCESS_1057.dll,InstantAccess
adult content premium rate dialler related
O16 - DPF: JT's Blocks - http://download.games.yahoo.com/games/clients/y/blt1_x.cab
O16 - DPF: Yahoo! Dice - http://download.games.yahoo.com/games/clients/y/dct4_x.cab
O16 - DPF: Yahoo! Towers 2.0 - http://download.games.yahoo.com/games/clients/y/ywt0_x.cab
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popc…aploader_v5.cab

Close all programs but HJT and all browser windows then click on "Fix Checked" Run your clean manager, make sure to empty all cookies and temp files. Empty the recycle bin and restart the computer. Use ADD REPLY, stay in this thread, post a new log using V1.99.1 and make sure not to cut off any of the log. Please also include any comments you think I should have.
Thanks…pskelley
TomCoyote forum
Slyware Warrior
If you get help here consider a donation:
http://tomcoyote.com/donate.php

SciTeach4u, You are still running HJT from a zip file in a temporary directory. Please understand if you need the backups in the event of an error, they may not be available. If you will look at my last post, item number three, you will see instuctions for fixing this.

I see nothing in your log that should be causing the popups you are describing. I will give you instruction to run scans, perhaps something is hidden that might show up in these scans. Follow these directions, keep a record of anything located and removed, also anything that is located and can't be removed by the scan software. The exact location and name of these items. Include this information in your next post.

INSTRUCTIONS:
1) Move HijackThis into a permanent folder as described earlier.

2) You have Spybot, I would like you to follow these directions, making sure Spybot is configured as in the instruction.
We need to run our big guns for cleaning out malware. Ad-aware and Spybot can get the areas we can't reach with the HJT tool. I am going to give you links to tutorials and it is important that you take the time to review the information, then to download, update, configure exactly as in the tutorials and remove what is suggested in the tutorials. Make notes of anything these two programs can't remove, the exact name and location of the item. Run Spybot first, if you receive any DSO Exploit notifications, ignore them and please do not activate TeaTimer at this time once you are clean you may activate it. If Spybot removes anything reboot before running Ad-aware SE Personal.
Spybot:
http://www.bleepingcomputer.com/forums/tutorial43.html
Ad-aware:
http://www.bleepingcomputer.com/forums/tutorial48.html

3) Free online scans
Now I want you to use these free online scans to kill, set them to clean/fix and remember we need the complete name and location of anything the scans locate but can't kill.
http://www.windowsecurity.com/trojanscan/
http://www.pandasoftware.com/activescan/co…n_principal.htm

4) If anything is located and removed during the scans, take the time to surf a little to see the the sorce of the problem has been removed. If not continue with all of the scans.

5) If you reach this point and have still not stopped the popups, then download this MWAV scan and run it:
http://www.mwti.net/antivirus/mwav.asp Here are the instructions:

Download mwavscan. Double-click it to run it, select all local drives, scan all files, press 'scan' and when it is completed, anything found will be displayed in the lower pane. Highlight it, CTRL C and paste it in your next reply.
This scan takes quite a while, it does not remove anything unless you buy it, I am interested in only the small log displayed in the lower pane. Copy and paste that information into this thread. DO NOT post the whole log, I have no need to see anything but the information in the lower pane.

Thanks…pskelley
TomCoyote forum
Slyware Warrior

Did not return to this post. Mar 4, 2005

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.