Nope, I'm in Australia - Any idea what that is?
O1 - Hosts: 194.162.4.16 aserver.dechema.de

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 11:00:12 PM, 3/01/2006
+ Report-Checksum: A0EB7E77

+ Scan result:

D:\Documents and Settings\Teresa\Cookies\teresa@112.2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@ad.yieldmanager[2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@adopt.euroclick[1].txt -> Spyware.Cookie.Euroclick : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@ads.addynamix[2].txt -> Spyware.Cookie.Addynamix : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@ads.pointroll[1].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@advertising[2].txt -> Spyware.Cookie.Advertising : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@atdmt[1].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@bfast[1].txt -> Spyware.Cookie.Bfast : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@bs.serving-sys[1].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@casalemedia[1].txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@counter8.sextracker[1].txt -> Spyware.Cookie.Sextracker : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@data.coremetrics[1].txt -> Spyware.Cookie.Coremetrics : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@e-2dj6wfkicncpigo.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@e-2dj6wfkound5kbp.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@e-2dj6wfkygjdzggo.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@e-2dj6wfl4wmdpmgo.stats.esomniture[1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@e-2dj6wfliqoazcbo.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@e-2dj6wgkiskdjobq.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@e-2dj6wjk4kgcpghp.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@e-2dj6wjk4qpcjeeq.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@e-2dj6wjlikgdpkfp.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@e-2dj6wjloahcjelp.stats.esomniture[1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@e-2dj6wjlykgc5oho.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@e-2dj6wjlyknajoko.stats.esomniture[1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@e-2dj6wjmyopczieq.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@e-2dj6wjnyclajoao.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@ehg-dig.hitbox[1].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@fastclick[1].txt -> Spyware.Cookie.Fastclick : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@hitbox[2].txt -> Spyware.Cookie.Hitbox : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@northwestairlines.1 12.2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@overture[1].txt -> Spyware.Cookie.Overture : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@qksrv[2].txt -> Spyware.Cookie.Qksrv : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@sales.liveperson[1].txt -> Spyware.Cookie.Liveperson : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@server.iad.livepers on[2].txt -> Spyware.Cookie.Liveperson : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@serving-sys[1].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@sextracker[2].txt -> Spyware.Cookie.Sextracker : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@statse.webtrendsliv e[2].txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
D:\Documents and Settings\Teresa\Cookies\teresa@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
D:\Documents and Settings\Teresa\Local Settings\Temporary Internet Files\Content.IE5\6ZGRJ85C\mm[1].js -> Spyware.Chitika : Cleaned with backup


::Report End

HijackThis Log

Logfile of HijackThis v1.99.1
Scan saved at 11:05:28 PM, on 3/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
D:\Program Files\ewido anti-malware\ewidoctrl.exe
D:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
D:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\RunDll32.exe
D:\Program Files\Logitech\iTouch\iTouch.exe
D:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
E:\Program Files\Winamp\winampa.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
D:\PROGRA~1\Nokia\7610\NOKIAP~1\TRAYAP~1.EXE
D:\Program Files\Strokeit\strokeit.exe
D:\Program Files\MSN Messenger\msnmsgr.exe
D:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
D:\Program Files\FinePixViewer\QuickDCF.exe
D:\Program Files\BenQ\Common\Bin\WinCinemaMgr.exe
D:\Program Files\WinZip\WZQKPICK.EXE
D:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
D:\WINDOWS\system32\wuauclt.exe
D:\WINDOWS\system32\NOTEPAD.EXE
D:\Program Files\Internet Explorer\iexplore.exe
D:\Documents and Settings\Teresa\My Documents\Downloaded Stuff\antivirus stuff\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bom.gov.au/cgi-bin/wrap_fwo.pl?IDN10064.txt
O1 - Hosts: 194.162.4.16 aserver.dechema.de
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - D:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-au\msntb.dll
O3 - Toolbar: ninemsn - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-au\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SiSUSBRG] D:\WINDOWS\sisUSBrg.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [zBrowser Launcher] D:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] D:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [REGSHAVE] D:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [USSShReg] D:\PROGRA~1\ULEADS~1\ULEADP~1\SSaver\Ussshreg.exe /r
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [WinampAgent] e:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DataLayer] D:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\PROGRA~1\Nokia\7610\NOKIAP~1\TRAYAP~1.EXE
O4 - HKCU\..\Run: [StrokeIt] D:\Program Files\Strokeit\strokeit.exe
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Skype] "e:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Acrobat Assistant.lnk = D:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = D:\Program Files\BenQ\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://d:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://d:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://d:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://d:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://d:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Use as &Display Picture - D:\Program Files\IEDP2\IEDP.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://80-www.mrw.interscience.wiley...r/tdserver.cab
O16 - DPF: {26CBF141-7D0F-46E1-AA06-718958B6E4D2} - http://download.ebay.com/turbo_lister/AU/install.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com...45/yacscom.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-18.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by108fd.bay108.hotmail.msn.co...s/MsnPUpld.cab
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.142/code/PWActiveXImgCtl.CAB
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/sof...iveXPlugin.cab
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yaho...opper1_3us.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex...l_v1-0-3-0.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab28177.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - D:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: Speed Disk service - Symantec Corporation - D:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Read about that 01 here and see if it sounds familiar to you:

http://www.dnsstuff.com/tools/whois.ch?ip=194.162.4.16


Log is clean, how is your computer behaving?


Let me know if that 01 looks familiar to you, if not I will make it go away. Read it carefully.

Nope, the whois doesn't seem familiar to me. I dont recognise any of that..?

No more popups *yay* Its running smoothly :-D

Ok sounds good, say good bye to the 01.

Please download hoster from the link below.

http://www.funkytoad.com/download/hoster.zip

Open Hoster.exe.

Then click on "Restore Original Hosts"

Close program when complete.



If you are no longer having any more trouble here is some preventative measures for you.

Here are some preventive measures you can take to keep your computer from getting infected again. also keep all these and Ad-awareSE and SpybotS&D updated.

http://forums.thatcomputerguy.us/ind...showtopic=1190

Flush your restore points in ME and XP, by turning System Restore off and then back on.
This will create a fresh restore point.

Explained here:
Windows XP: service1.symantec.com/SUPPORT/tsgen...src=sec_doc_nam

Microsoft ME:

http://service1.symantec.com/SUPPORT...rc=sec_doc_nam


RegProtect

This small registry protection tool will save you hours of heartache by notifying you when some program good or bad is trying to access your registry.

You have the option of allowing(good) items or blocking(bad)items.

http://www.diamondcs.com.au/index.php?page=regprot


To reduce the re-infection potential for malware and protect yourself against spyware, here are a few helpful suggestions:

1. Keep Windows and Internet Explorer current with the latest critical security updates from Microsoft. This will patch many of the security holes through which attackers can gain access to your computer. You CANNOT complete this update using an alternate browser.
http://v5.windowsupdate.microsoft.co....aspx?ln=en-us

http://www.microsoft.com/windows/ie/default.asp


2. Run your antivirus software regularly, and to keep its definitions up-to-date. If you are thinking about switching, there are a some good free Antivirus programs that are decent, including AVG and Avast!.
AVG: http://free.grisoft.com/doc/1

Avast: http://www.avast.com/eng/avast_4_home.html


3. In addtion to using Ad-aware consider using another free malware scanning/removal program:
MS Antispyware beta: http://www.microsoft.com/athome/secu...e/default.mspx


4. Consider using a free firewall if you are not already using one. Some good free ones are:
Kerio
http://www.sunbelt-software.com/Kerio.cfm

OutPost Personal Firewall:
Outpost



5. Consider using an alternate free browser for general web surfing but you must use IE for windows update.
Mozilla Firefox: www.mozilla.org/products/firefox/


6. Consider increasing your browser security by using these programs:
SpywareGuard will protect your homepage from being hijacked: http://www.javacoolsoftware.com/spywareguard.html
SpywareBlaster will increase browser protection by blocking Thousands of known malware sites by adding them to IE's restricted sites zone. Download it here:

http://www.javacoolsoftware.com/spywareblaster.html


If you use SpywareBlaster, you can also use a customblocklist to add even more entries into IE restricted sites zone. Go to this site for the current list and how to use instructions: http://customblockinglist.cjb.net/


IE-SPYAD is similar in that it adds thousands more known malware sites to IE's restricted zone. Download it here:
https://netfiles.uiuc.edu/ehowes/www/resource.htm


*Remember just like your primary anti-virus software, it is important to keep all of these programs up-to-date and use them on a regular basis. It's Free