popup ads constantly harassing

Logfile of HijackThis v1.97.7
Scan saved at 10:57:52 PM, on 9/2/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\SECRETMAKER\secretmaker.exe
C:\Documents and Settings\Denise\Desktop\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\Denise\Application Data\Mozilla\Profiles\default\zcmd8del.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\Denise\Application Data\Mozilla\Profiles\default\zcmd8del.slt\prefs.js)
O1 - Hosts: 207.68.176.250 auto.search.msn.com
O1 - Hosts: 64.12.152.18 search.netscape.com
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_5_0.dll
O2 - BHO: (no name) - {A491D208-B353-490F-B81A-A8A3DC97042D} - C:\WINNT\system32\smiehlp.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_5_0.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common Files\WinTools\WToolsA.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: SECRETMAKER.lnk = C:\Program Files\SECRETMAKER\secretmaker.exe
O9 - Extra button: AIM (HKLM)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls/SassCln.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Here's the latest one. Only thing I couldn't find was the C:\Programfiles\Commonfiles|WinTools\WSup.exe to delete when I was in safe mode. But I did everything else. Also a new problem----I couldn't get the msconfig to come up. When I went to Start/Run and typed in msconfig a window popped up saying this----Cannot find file 'msconfig' ( or one of it's components). Make sure the path and filename are correct and that all required libraries are available. So I don't understand that one. OK Now what?

Hi yleecoyote26
I just noticed that you're using W2K
There's no "msconfig" command in W2K by default.
But you can add it to your system:
Go to this site and download msconfig and place it in C:\WINNT\SYSTEM32
http://www.techadvice.com/specs/files_dl.asp?fnid=3398288
Then click Start\Run and type msconfig .
Go to Startup tab and choose which programs should load at startup by checking them then restart. A box will appear, so just check don't show this message again.

Cyanure, Thanks for the advice, but I downloaded it and tried Start/Run and typed it in and the message window still popped up saying I don't have it. Don't know what I did but it says I downloaded it from that site you gave me.

Please download it again from here (350 KB), and be sure to download the one compatible with Windows 2000:
http://www.3feetunder.com/krick/startup/
And be sure to put it in SYSTEM32 folder in C:\WINNT
Then go to Start/Run and type MSCONFIG

(And in the Norton Options, it has one option that let it load at startup. Just see if it's checked)

Cyanure,
Ok did it again from the second site and it works now BUT...I can't get it to take Norton's or anything else. What I mean is I can't type in something to add it to the start up list. And I am not sure where it went too, it didn't ask me anything, so I think it's in the temp file. Not C:\WINNT\SYSTEM32. Here's what it has for start up on it right now-----mobsync, AVGNT, avgcc, msnmsgr, aim, secretmaker.
Those are fine but I'd like Norton's to be on there and I still can't get my icon back in the lower right hand toolbar for my printer.
I did check with Norton Options and it WON'T let me check the load at startup box and it has an ERROR for the email one. And so far I don't know what is making it like that or if there is something missing that made it that way. I can't get any answers from Norton (Symantec). Thanks for all your help. At least the pop ups have pretty much stopped or are being blocked. Now if I could just get the rest of this straightened out.

You just don't have to write anything. You just check or uncheck.
For example, look at the pic below, if you check the small square with the green mark next NeroCheck, then Nero will load at startup and the icon will appear in the lower right toolbar.
If you check ypager, then yahoo messenger will load at startup. If you didn't check it, then it will not load and there will be no icon in the lower right toolbar.



Put a green check next avgcc, it will let your antivirus load at startup.
Locate the square that points to your printer and check it.

Please let me know the result.

This is all there is in the msconfig for start up-----
mobsync, AVGNT, avgcc, msnmsgr, aim, secretmaker.
That's it and they are all checked. There is nothing else to put a check by. That's what I'm saying, there is no way to add anything else on. Everything I just listed is already checked and starts. I want Norton's back and my printer, but somehow I think it was deleted off the start up list and I don't know how to get it back there.

Please click Start/Run and type regedit

navigate to:

HKLM>Software>Microsoft>WindowsNT>CurrentVersion>Winlogon

Click the yellow folder of Winlogon
Look in the right panel for Shell
Please tell me what is written next to it.

and check this tool:
Tray 2000 which let you place up to 24 programs in your taskbar tray:

http://www.download.com/Tray-Tools-2000/3000-2344-6955680.html?tag=lst-0-1

It's free

Here's what it said-------
AB Shell REG_SZ EXPLORER.EXE

That's all it said. And I am trying the other. Thanks.

Good

If Tray 2000 didn't work, try to uninstall the printer then reinstall it again and see the result.
If it works do the same thing for Norton

I can't uninstall Norton 2003 I don't have the CD for it. It came on the computer.

Didn't want to jump back in on this, Your in good hands with Cyanure , But I do have a question, You say you have avg running from start up ( well on what you told is running at start up avg), which is good
Then why do you want Norton's running again?
Bad idea to have to Anti Virus priograms running,

The AVG 7.0 is only lasting for another 20 days, it's a trial of it. Seems they won't give me the link to get the free version. Besides, Norton's was always pretty good on here.

yleecoyote26
please check your private message

Thanks for everyone's help!!! I pretty much have the pop ups under control (for now) but I have to get the computer running right now. Just wanted to thank everyone.