Hi, I get pop-up's (that should not be there) on web sites I visit often. Please help me get rid of this problem. Here is a copy of the hijackthis.log: -------- Logfile of HijackThis v1.97.6 Scan saved at 15:00:34, on 17-11-03 Platform: Windows NT 4 SP6 (WinNT 4.00.1381) MSIE: Internet Explorer v5.51 SP2 (5.51.4807.2300) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\spoolss.exe C:\Program Files\NavNT\defwatch.exe C:\Program Files\NavNT\rtvscan.exe C:\WINNT\system32\RpcSs.exe c:\winnt\system32\pstores.exe C:\WINNT\system32\MSTask.exe C:\Program Files\Citrix\ICA Client\ssonsvr.exe C:\WINNT\System32\nddeagnt.exe C:\WINNT\Explorer.exe C:\WINNT\System32\MsgSys.exe C:\WINNT\System32\atiptaxx.exe C:\WINNT\System32\loadwc.exe C:\PROGRA~1\NavNT\vptray.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Microsoft Office\Office\FINDFAST.exe C:\Program Files\Microsoft Office\Office\OSA.exe C:\WINNT\System32\ddhelp.exe C:\WINNT\system32\tapisrv.exe C:\PROGRA~1\Citrix\ICACLI~1\Wfcrun32.exe C:\PROGRA~1\Citrix\ICACLI~1\WFICA32.exe C:\PROGRA~1\Plus!\MICROS~1\iexplore.exe C:\tek\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.search-1.net/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.search-1.net/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.search-1.net/search.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchv.com/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchv.com/5/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchv.com/5/search.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchv.com/1/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.search-1.net/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.searchv.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.searchv.com/search.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchv.com/5/search.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.search-1.net/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.searchv.com/5/search.php?qq=%s R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = http://www.search-1.net/search.html R1 - HKCU\Software\Microsoft\Internet Explorer,CustomizeSearch = http://www.search-1.net/search.html F2 - REG:system.ini: UserInit=userinit,nddeagnt.exe O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: WinShow module - {6CC1C918-AE8B-4373-A5B4-28BA1851E39A} - C:\WINNT\winshow.dll O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [SystemTray] SysTray.exe O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe O4 - HKLM\..\Run: [BrowserWebCheck] loadwc.exe O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NavNT\vptray.exe O4 - HKLM\..\Run: [SchedulingAgent] mstinit.exe /logon O4 - HKLM\..\Run: [QuickTime Task] "C:\WINNT\System32\qttask.exe" -atboottime O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0 O4 - HKLM\..\RunOnce: [WinShowUpdate] copy C:\WINNT\winshow.new C:\WINNT\winshow.dll O4 - Startup: AntiVirus.lnk = NAV\us.bat O4 - Startup: Citrix01 2 desktops.lnk = C:\Program Files\Citrix\ICA Client\pn.exe O4 - Global Startup: Microsoft Hurtig søgning.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.exe O4 - Global Startup: Microsoft Office-start.lnk = C:\Program Files\Microsoft Office\Office\OSA.exe O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM) O12 - Plugin for .pdf: C:\PROGRA~1\Plus!\MICROS~1\PLUGINS\nppdf32.dll O12 - Plugin for .spop: C:\PROGRA~1\Plus!\MICROS~1\Plugins\NPDocBox.dll O13 - WWW. Prefix: http:// O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab O16 - DPF: {F6A56D95-A3A3-11D2-AC26-400000058481} (Danske e-Sec) - https://netbank.danskebank.dk/netbank/activex/DanskeSikker.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = dst.dk O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = dst.dk O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 10.1.10.13 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 10.1.10.13

I downloaded CWShredder and fix the problem myself.

Get rid of IE , download Netscape 7.X , has built in popup stopper ,you'll never see another popup if you switch to Netscape.