Hi, A popup asking me to connect to the internet appears again and again. A program is requesting the addresses www.smutfantazy.com or 66.250.131.242. The IE is not even running, and I cannot identify the program trying to connect. Tried several things: Searching for virus' or spy's by F-Secure, Spyhunter, HijackThis. Some ideas how to cure this? Regards, Martin

You probalby have a dialer that is trying to connect all the time. check our internet connections to see if you have a dialup listed that you do not recognize. Also check your startup in msconfig to see what programs are running in your startup. Post the Hijackthis log too.

Hi, My internet connection seems okay. Here is the Hijackthis log: Regards, Martin Logfile of HijackThis v1.97.7 Scan saved at 17:06:14, on 14.12.2003 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\PERSON~1\backweb\2581593\Program\SERVIC~1.exe C:\Programme\Conceptronic\Bluetooth Software\bin\btwdins.exe C:\Programme\Personal Security Service\Anti-Virus\fsgk32st.exe C:\Programme\Personal Security Service\backweb\2581593\program\fsbwsys.exe C:\Programme\Personal Security Service\Anti-Virus\FSGK32.exe C:\Programme\Personal Security Service\Anti-Virus\fssm32.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Personal Security Service\Common\FSMA32.exe C:\Programme\Personal Security Service\Common\FSMB32.exe C:\Programme\Personal Security Service\Common\FCH32.exe C:\Programme\Personal Security Service\Common\FAMEH32.exe C:\Programme\Personal Security Service\Anti-Virus\fsav32.exe C:\Programme\Personal Security Service\DFW\Program\fsdfwd.exe C:\WINDOWS\Explorer.exe C:\Programme\Winamp3\winampa.exe C:\Programme\winex\v2\winex.exe C:\Programme\Gemeinsame Dateien\Microsoft Shared\DAO\Real\Update_OB\realsched.exe C:\WINDOWS\System32\wuauclt.exe C:\Programme\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\Programme\Logitech\MouseWare\system\em_exec.exe C:\Programme\Personal Security Service\Common\FSM32.exe C:\WINDOWS\System32\ctfmon.exe C:\Programme\Messenger\msmsgs.exe C:\windows\winlogon.exe C:\Programme\Conceptronic\Bluetooth Software\BTTray.exe C:\WINDOWS\System32\rasautou.exe C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe C:\Programme\Personal Security Service\backweb\2581593\Program\BackWeb-2581593.exe C:\PROGRA~1\CONCEP~1\BLUETO~1\BTSTAC~1.exe C:\Dokumente und Einstellungen\molz\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.windowenhancer.com/searchbar/iev1.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.windowenhancer.com/nph-WESearch.cgi?partner=wesearch&kw= R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.windowenhancer.com/nph-WESearch.cgi?partner=wesearch&kw= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.windowenhancer.com/searchbar/iev1.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.windowenhancer.com/nph-WESearch.cgi?partner=wesearch&kw= R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.windowenhancer.com/nph-WESearch.cgi?partner=wesearch&kw= R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.windowenhancer.com/nph-WESearch.cgi?partner=wesearch&kw= R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.windowenhancer.com/nph-WESearch.cgi?partner=wesearch&kw= R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R3 - URLSearchHook: (no name) - {9368D063-44BE-49B9-BD14-BB9663FD38FC} - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Programme\Winamp3\winampa.exe" O4 - HKLM\..\Run: [WindowEnhancer] "C:\Programme\winex\v2\winex.exe" /U O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Microsoft Shared\DAO\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.exe O4 - HKLM\..\Run: [MMTray] C:\Programme\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKLM\..\Run: [F-Secure Manager] "C:\Programme\Personal Security Service\Common\FSM32.exe" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Programme\Personal Security Service\TNB\TNBUtil.exe" /CHECKALL O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [winlogon] c:\windows\winlogon.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.exe O9 - Extra button: Recherche-Assistent (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O16 - DPF: {00000000-663f-49e8-bdf6-f26db51c7dd5} - O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {486E48B5-ABF2-42BB-A327-2679DF3FB822} - http://akamai.downloadv3.com/binaries/IA/ia_XP.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/074203152d9e19b85705/netzip/RdxIE601_de.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37647.1547800926 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = tivita.net O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = tivita.net

When the request pops up look at your "settings" and make sure the button that is next to "never dial the connection" is checked. this might correct the problem. I have had the same thing happen and when I changed that it never came back.