I cant find the problem in my log. theres these random porn popups that come up once in about 20 page views by the address of Www.lastxdoor.com can someone help me? Heres the log: Scan saved at 7:38:54 PM, on 7/29/2003 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\System32\devldr32.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe C:\windows\winlogon.exe C:\Program Files\AIM95\aim.exe C:\Program Files\Internet Explorer\IEXPLORE.exe C:\Program Files\Internet Explorer\IEXPLORE.exe C:\Program Files\Internet Explorer\IEXPLORE.exe C:\Program Files\Internet Explorer\IEXPLORE.exe C:\Program Files\Internet Explorer\IEXPLORE.exe C:\WINDOWS\system32\rundll32.exe C:\Documents and Settings\Ellison Yeung\Desktop\HijackThis.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.exe O4 - HKLM\..\Run: [Ad-watch] C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe O4 - HKLM\..\Run: [Ad-aware] C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe +c O4 - HKCU\..\Run: [winlogon] c:\windows\winlogon.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: AIM (HKLM) O16 - DPF: Yahoo! Word Racer - http://download.games.yahoo.com/games/clients/y/wt0_x.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstallers/MetaStream3.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://apple.speedera.net/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.dell.com/us/en/systemprofiler/SysProfLcd.CAB O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37793.8118171296 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw12fd.law12.hotmail.msn.com/activex/HMAtchmt.ocx O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab

This is the culprit: O4 - HKCU\..\Run: [winlogon] c:\windows\winlogon.exe Run HT again and have it fix the following and reboot. O4 - HKCU\..\Run: [winlogon] c:\windows\winlogon.exe After rebooting delete c:\windows\winlogon.exe ** Do not delete the winlogon.exe that is in C:\Windows\System32

Yea i found that was the problem thanks alot tom41!

help me...what do i do?? here is the log Logfile of HijackThis v1.96.2 Scan saved at 3:28:44 PM, on 8/29/2003 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.exe C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MPREXE.exe C:\WINDOWS\SYSTEM\MSTASK.exe C:\PROGRAM FILES\NORTON ANTIVIRUS\RTVSCN95.exe C:\PROGRAM FILES\NORTON ANTIVIRUS\DEFWATCH.exe C:\WINDOWS\EXPLORER.exe C:\WINDOWS\SYSTEM\RESTORE\STMGR.exe C:\WINDOWS\TASKMON.exe C:\WINDOWS\SYSTEM\SYSTRAY.exe C:\PROGRAM FILES\NETROPA\MULTIMEDIA KEYBOARD\MMKEYBD.exe C:\PROGRAM FILES\NETROPA\MULTIMEDIA KEYBOARD\MMUSBKB2.exe C:\WINDOWS\SYSTEM\LTMSG.exe C:\WINDOWS\SYSTEM\WMIEXE.exe C:\WINDOWS\LOADQM.exe C:\PROGRAM FILES\NORTON ANTIVIRUS\VPTRAY.exe C:\PROGRAM FILES\NETROPA\MULTIMEDIA KEYBOARD\TRAYMON.exe C:\PROGRAM FILES\COMMON FILES\CMEII\CMESYS.exe C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.exe C:\PROGRAM FILES\WINAMP\WINAMPA.exe C:\PROGRAM FILES\MESSENGER\MSMSGS.exe C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.exe C:\PROGRAM FILES\COMMON FILES\GMT\GMT.exe C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.exe C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\MSOFFICE.exe C:\WINDOWS\SYSTEM\RNAAPP.exe C:\WINDOWS\SYSTEM\TAPISRV.exe C:\PROGRAM FILES\AIM95\AIM.exe C:\PROGRAM FILES\NORTON ANTIVIRUS\VPC32.exe C:\PROGRAM FILES\WINZIP\WINZIP32.exe C:\WINDOWS\TEMP\HIJACKTHIS.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie-search.com/srchasst.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie-search.com/home.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie-search.com/home.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie-search.com/srchasst.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie-search.com/srchasst.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie-search.com/srchasst.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.kazaa-lite.ws/results.php?show= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.kazaa-lite.ws/results.php?show= R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ie-search.com/home.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.kazaa-lite.ws/ F1 - win.ini: run=hpfsched O1 - Hosts: 1123694712 auto.search.msn.com O1 - Hosts: 1123694712 auto.search.msn.com O1 - Hosts: 66.159.20.80 www1.ndhosting.com O1 - Hosts: 66.159.20.80 www3.ndhosting.com O1 - Hosts: 66.159.20.80 www2.ndhosting.com O1 - Hosts: 66.159.20.80 www.ndhosting.com O1 - Hosts: 66.159.20.80 www.kinghost.com O1 - Hosts: 66.159.20.80 kinghost.com O1 - Hosts: 66.159.20.80 www1.kinghost.com O1 - Hosts: 66.159.20.80 www2.kinghost.com O1 - Hosts: 66.159.20.80 www3.kinghost.com O1 - Hosts: 66.159.20.80 www4.kinghost.com O1 - Hosts: 66.159.20.80 www5.kinghost.com O1 - Hosts: 66.159.20.80 www6.kinghost.com O1 - Hosts: 66.159.20.80 www7.kinghost.com O1 - Hosts: 66.159.20.80 www8.kinghost.com O1 - Hosts: 66.159.20.80 www9.kinghost.com O1 - Hosts: 66.159.20.80 www10.kinghost.com O1 - Hosts: 66.159.20.80 www.smutserver.com O1 - Hosts: 66.159.20.80 smutserver.com O1 - Hosts: 66.159.20.80 www1.smutserver.com O1 - Hosts: 66.159.20.80 www2.smutserver.com O1 - Hosts: 66.159.20.80 www16.smutserver.com O1 - Hosts: 66.159.20.80 www3.smutserver.com O1 - Hosts: 66.159.20.80 www4.smutserver.com O1 - Hosts: 66.159.20.80 www5.smutserver.com O1 - Hosts: 66.159.20.80 www6.smutserver.com O1 - Hosts: 66.159.20.80 www7.smutserver.com O1 - Hosts: 66.159.20.80 www8.smutserver.com O1 - Hosts: 66.159.20.80 www9.smutserver.com O1 - Hosts: 66.159.20.80 www10.smutserver.com O1 - Hosts: 66.159.20.80 www11.smutserver.com O1 - Hosts: 66.159.20.80 www12.smutserver.com O1 - Hosts: 66.159.20.80 www13.smutserver.com O1 - Hosts: 66.159.20.80 www14.smutserver.com O1 - Hosts: 66.159.20.80 www15.smutserver.com O1 - Hosts: 66.159.20.80 www17.smutserver.com O1 - Hosts: 66.159.20.80 www18.smutserver.com O1 - Hosts: 66.159.20.80 www19.smutserver.com O1 - Hosts: 66.159.20.80 www20.smutserver.com O1 - Hosts: 66.159.20.80 www21.smutserver.com O1 - Hosts: 66.159.20.80 www22.smutserver.com O1 - Hosts: 66.159.20.80 www23.smutserver.com O1 - Hosts: 66.159.20.80 www24.smutserver.com O1 - Hosts: 66.159.20.80 www25.smutserver.com O1 - Hosts: 66.159.20.80 www26.smutserver.com O1 - Hosts: 66.159.20.80 www27.smutserver.com O1 - Hosts: 66.159.20.80 www28.smutserver.com O1 - Hosts: 66.159.20.80 www29.smutserver.com O1 - Hosts: 66.159.20.80 www30.smutserver.com O1 - Hosts: 66.159.20.80 www31.smutserver.com O1 - Hosts: 66.159.20.80 www32.smutserver.com O1 - Hosts: 66.159.20.80 agreathost.net O1 - Hosts: 66.159.20.80 www.agreathost.net O1 - Hosts: 66.159.20.80 hotfreehost.com O1 - Hosts: 66.159.20.80 www.hotfreehost.com O1 - Hosts: 66.159.20.80 greatfreehost.com O1 - Hosts: 66.159.20.80 www.greatfreehost.com O1 - Hosts: 66.159.20.80 freesmutpages.com O1 - Hosts: 66.159.20.80 www.freesmutpages.com O1 - Hosts: 66.159.20.80 apornhost.com O1 - Hosts: 66.159.20.80 www.apornhost.com O1 - Hosts: 66.159.20.80 nasty-pages.com O1 - Hosts: 66.159.20.80 www.nasty-pages.com O1 - Hosts: 66.159.20.80 sexyfreehost.com O1 - Hosts: 66.159.20.80 www.sexyfreehost.com O1 - Hosts: 66.159.20.80 x4web.com O1 - Hosts: 66.159.20.80 www.x4web.com O1 - Hosts: 66.159.20.80 sexplanets.com O1 - Hosts: 66.159.20.80 www.sexplanets.com O1 - Hosts: 66.159.20.80 maxismut.com O1 - Hosts: 66.159.20.80 www.maxismut.com O1 - Hosts: 66.159.20.80 tgpfriendly.com O1 - Hosts: 66.159.20.80 www.tgpfriendly.com O1 - Hosts: 66.159.20.80 tgp-server.com O1 - Hosts: 66.159.20.80 www.tgp-server.com O1 - Hosts: 66.159.20.80 magnaplza.com O1 - Hosts: 66.159.20.80 www.magnaplza.com O1 - Hosts: 66.159.20.80 free-xxx-server.com O1 - Hosts: 66.159.20.80 www.free-xxx-server.com O1 - Hosts: 66.159.20.80 libereco.net O1 - Hosts: 66.159.20.80 www.libereco.net O1 - Hosts: 66.159.20.80 0190-dialer.com O1 - Hosts: 66.159.20.80 www.0190-dialer.com O1 - Hosts: 66.159.20.80 xxxod.net O1 - Hosts: 66.159.20.80 www.xxxod.net O1 - Hosts: 66.159.20.80 altsights.com O1 - Hosts: 66.159.20.80 www.altsights.com O1 - Hosts: 66.159.20.80 adulthosting.com O1 - Hosts: 66.159.20.80 www.adulthosting.com O1 - Hosts: 66.159.20.80 superhova.com O1 - Hosts: 66.159.20.80 www.superhova.com O1 - Hosts: 66.159.20.80 bestpornhost.com O1 - Hosts: 66.159.20.80 www.bestpornhost.com O1 - Hosts: 66.159.20.80 hostingfree.com O1 - Hosts: 66.159.20.80 www.hostingfree.com O1 - Hosts: 66.159.20.80 xfreehosting.com O1 - Hosts: 66.159.20.80 www.xfreehosting.com O1 - Hosts: 66.159.20.80 blinghosting.com O1 - Hosts: 66.159.20.80 www.blinghosting.com O1 - Hosts: 66.159.20.80 x-x-x-hosting.com O1 - Hosts: 66.159.20.80 www.x-x-x-hosting.com O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s O4 - HKLM\..\Run: [SystemTray] SysTray.exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9 O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NORTON~1\vptray.exe O4 - HKLM\..\Run: [CMESys] "C:\PROGRAM FILES\COMMON FILES\CMEII\CMESYS.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\PROGRAM FILES\WINAMP\WINAMPa.exe" O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [rtvscn95] C:\PROGRA~1\NORTON~1\rtvscn95.exe O4 - HKLM\..\RunServices: [defwatch] C:\PROGRA~1\NORTON~1\defwatch.exe O4 - HKCU\..\Run: [MSMSGS] C:\PROGRA~1\MESSEN~1\msmsgs.exe /background O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe O4 - Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.exe O4 - Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.exe O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM) O9 - Extra button: Encarta Encyclopedia (HKLM) O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM) O9 - Extra button: Define (HKLM) O9 - Extra 'Tools' menuitem: Define (HKLM) O9 - Extra button: Real.com (HKLM) O9 - Extra button: AIM (HKLM) O16 - DPF: {A1DC3241-B122-195F-B21A-000000000000} - http://pluginaccess.com/Browser_Plugin.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potb_x.cab O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://i.a.cnn.net/cnn/resources/cult3d/cult.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37816.5865277778 O16 - DPF: {C1BAC744-8F0B-11D0-89E7-00C0A8295197} (Cameractl Class) - http://www.berkeley.edu/webcams/camera.cab