Wasted 2 Days Already

Not sure if you wanted me to uncheck Hide Standard NTFS Metadata files under Options but I did. Here is the report:

can you run that again and leave Hide Standard NTFS Metadata files checked


aslo make sure you update firefox

When I scan with network unplugged, there was only one discrepancy on the D drive. I plugged the network cable back on and it found 6 more. Should I wait till the pop ups appear and then scan again? BTW, I am already using the newest version of Mozilla Firefox. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Directory 6/6/2006 4:43 PM 168 bytes Windows API length not consistent with raw hive data. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1\CachePath 6/6/2006 4:43 PM 182 bytes Windows API length not consistent with raw hive data. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2\CachePath 6/6/2006 4:43 PM 182 bytes Windows API length not consistent with raw hive data. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3\CachePath 6/6/2006 4:43 PM 182 bytes Windows API length not consistent with raw hive data. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4\CachePath 6/6/2006 4:43 PM 182 bytes Windows API length not consistent with raw hive data. D: 0 bytes Error mounting volume

Disabling the Messenger Service To remove the ability for anyone in the world to pop up messages on your computer, you can disable the Messenger service. Its easy to reverse at a later time if you wish to do so. Windows XP Home Click Start->Settings ->Control Panel Click Performance and Maintenance Click Administrative Tools Double click Services Scroll down and highlight "Messenger" Right-click the highlighted line and choose Properties. Click the STOP button. Select Disable or Manual in the Startup Type scroll bar Click OK Windows XP Professional Click Start->Settings ->Control Panel Click Administrative Tools Click Services Double click Services Scroll down and highlight "Messenger" Right-click the highlighted line and choose Properties. Click the STOP button. Select Disable or Manual in the Startup Type scroll bar Click OK

After my last reboot, I have not opened any browsers and it has been quiet for more than 15 minutes. If it remains quiet, it must have something to do with the browsers. After I open Firefox, something is changed and the popups reappear. Does this help? I think I rebooted without the network connected the last time. If I reboot with the network connected, MSN Messenger will try to log in and then the popups will reappear. Still no popups yet.

Try my last post and see if that works. Did you update FireFox?

I have disabled Messenger. By updating Firefox, do you mean downloading and reinstalling? I am already using the latest version 1.5.0.4 Shall I reboot and see what happens? Or simply open a browser?

I am already using the latest version 1.5.0.4

OK.

Try opening a browser. If no popups, then reboot nd see what happens.

Ewido updated itself and is on guard. SpySweeper is on. Opened Firebox browser and navigated a little. Still no popups. Will continue to wait and navigate for a few more minutes. If no popups, I will restart and see what happens.

Fingers are crossed

Just rebooted, MSN Messenger came up with the log on screen. I did not sign in. Checked Services and still see it disabled. Opened Firefox and navigated around to other sites such as MSN.com, Google.com, Amazon.com….still NO POP UPS!!! So far so good!! ***Still no pop ups! I will continue to play around tonight. Will stay away from MSN Messenger! Do we need to clean up some files? What about other programs such as Mediaplayer and ITunes? Shall I stay away from them for now?

Lets see what happens. If all goes well, post a new HijackThis log and we'll do some cleaning

All seemed to be working well UNTIL I logged on to Yahoo Messenger! Pop ups reappear. Wonder if it has to do with that. It was not automatically started. 1. Checked Services..do not see any place to disable it. 2. Rebooted computer with network connected. Pop ups reappeared. 3. Rebooted computer with cable unplugged. 4. Reconnected cable. 5. Opened browsers. Quiet again. Must be something attached to those programs when I use them to communicate. 6. Rebooted computer with cable plugged in this time. 7. Opened Browsers…..let's see what happens…nothing yet…..

Pop ups came back after a half hour. Now what? Talk to you tomorrow!

If it's Inside Yahoo, you can set settings to no popups

Messenger/Preferences/General.
uncheck Show Inside Yahoo!.

Lets also do this:

Please download hoster from the link below.

http://www.funkytoad.com/download/hoster.zip

Unzip Hoster.zip
Open Hoster.exe.

Then click on "Restore Original Hosts"

Close program when complete.


Download this file from the link to your desktop.
http://www.mvps.org/winhelp2002/DelDomains.inf

Click "Save" and save it to your desktop.

Right-click on the deldomains.inf file and select 'install'

Once it is finished your Zones should be reset.

Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.

Thanks, I'll try that and post the log. BTW, I opened Task Manager and checked Processes. I then did a search on the .exe files listed. I noticed some of the files for e.g. explorer.exe, spoolsv.exe, lsass.exe, services.exe, taskmgr.exe, alg.exe etc are located in C:\Windows\System32 and also C:\Windows\Software Distribution\Download\16b2c96a0c414dfdb4d3cc288a4f819 Shouldn't they be located in just the System32 folder?