I used the AnalyzeThis program to generate this log file. Please let me know how I can get rid of these damn popups. Thanks.
Aaron
Running processes:
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\support.com\bin\tgcmd.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\ouss\nots.exe
C:\WINDOWS\system32\r?ndll.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
https://login.express.cites.uiuc.edu/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
https://login.express.cites.uiuc.edu/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
http://support.dell.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Insight Broadband
O2 - BHO: (no name) - {625D4DAA-A31E-A193-4C47-DC2FF593F8E9} - C:\WINDOWS\system32\ysgnd.dll
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [SAClient] "C:\Program Files\Insight\BBClient\Programs\RegCon.exe" /admincheck
O4 - HKCU\..\Run: [Irom] C:\Program Files\ouss\nots.exe
O4 - HKCU\..\Run: [Llx] C:\WINDOWS\system32\r?ndll.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} -
http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} -
http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} -
http://online.comcast.net/help/ (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.insightbb.com
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) -
http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) -
http://download.games.yahoo.com/games/web_games/popcap/bejeweled2/popcaploader_v6.cab
End of KRC HijackThis Analyzer Log.
====================================================================
