Hijackthis log, ad.oinadserver.com

Stupis pop-ups jumping out of everywhere, even tho i use firefox.

Logfile of HijackThis v1.99.1
Scan saved at 3:45:38 PM, on 02/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\ASKS~1\csrss.exe
C:\WINDOWS\SYSTEM32\?dobe\spoolsv.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cool.exe
C:\WINDOWS\TEMP\winE6D.tmp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\TEMP\winC7.tmp.exe
C:\Documents and Settings\Alex\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O4 - HKLM\..\Run: [msci] C:\DOCUME~1\Jay\LOCALS~1\Temp\2006719222232_mcinfo .exe /insfin
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [Waac] "C:\WINDOWS\ASKS~1\csrss.exe" -vt yazr
O4 - HKCU\..\Run: [Nnfvqt] C:\WINDOWS\SYSTEM32\?dobe\spoolsv.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\clbcatix.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\clbcatix.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\clbcatix.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh...0/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1153525299875
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} (YazzleActiveX Control) - http://yax-download.yazzle.net/Yazzl...cab?refid=1123
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.lizardtech.com/download/f...all/isetup.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab32846.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{23863AB3-3829-46A7-8277-4A72119F8DA4}: NameServer = 198.164.30.2,198.164.4.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{23863AB3-3829-46A7-8277-4A72119F8DA4}: NameServer = 198.164.30.2,198.164.4.2
O17 - HKLM\System\CS2\Services\Tcpip\..\{23863AB3-3829-46A7-8277-4A72119F8DA4}: NameServer = 198.164.30.2,198.164.4.2
O17 - HKLM\System\CS3\Services\Tcpip\..\{23863AB3-3829-46A7-8277-4A72119F8DA4}: NameServer = 198.164.30.2,198.164.4.2
O17 - HKLM\System\CS4\Services\Tcpip\..\{23863AB3-3829-46A7-8277-4A72119F8DA4}: NameServer = 198.164.30.2,198.164.4.2
O17 - HKLM\System\CS5\Services\Tcpip\..\{23863AB3-3829-46A7-8277-4A72119F8DA4}: NameServer = 198.164.30.2,198.164.4.2
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: C:\WINDOWS\system32\winword.dll
O21 - SSODL: cinnamomum - {93ac7c30-3878-4eaa-9420-7977285df5b1} - (no file)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

Welcome,


The tool below called Ewido needs to be run from safe mode explained below.





Download and install
Ewido anti-spyware
4.0 (uninstall any previous version first).

• Click the Download BUTTON. On the next page click the
  Download now BUTTON.
• Save and then install (Run) from the save location.
  
• Open/Run ewido anti-spyware
  
• Wait a few moments and Ewido should Auto update itself (note date of last
  update). If it doesn't update, click the update ICON at top of
  screen:
  
  
  Quote:

  Click on the Update now LINK at the top of the window Click on the Start update button Wait for the update to download and install

• This is very important to get the LATEST
  updates
  
• Click on the Status ICON
  • Under "Your computers Security"
    Click change status on Resident shield to inactive
    (ONLY consider activation of that feature once you are
    clean)
• Click on the Scanner ICON at the top of the window
  
• Click on the Settings tab then select Recommended Actions
  and choose Quarantine

Close ALL open Windows / Programs / Folders. Please start
Ewido, and run a full scan:

• Click on the default Status ICON and select
  the Scan now LINK.
  
  OR
  
  
• Click on the Scanner ICON . Select the Scan
  TAB.
  
  
  • Select Complete System Scan. Ewido will now begin to scan your
    system.

• If Ewido finds anything it will list them in the Preview WINDOW:
  • Make sure that Set all elements to: shows
    Quarantine, if not click on the link and choose
    Quarantine from the popup menu.
  • Select Apply all actions at the bottom of the window (and the
    items found will be quarantined - and recoverable, if any items are needed
    back).
  
  
• When the scan has completed, click on the Save Scan Report button
  and save the scan to your Desktop where it can be easily found.
• Copy and paste the EWIDO scan results into your next
  post.
• Close Ewido.

How to get to safe mode:Now reboot into safe mode by tapping your F8 key upon restart and safe mode screen appears, select safe mode and press enter and run Ewido and save the log for me to look at..


Then reboot normal mode and...



Go to Start>Control Panel>Add/Remove Programs and look for PuritySCAN By OIN, , OIN or similar or Click Spring , click on it and click remove.

If not listed, download and run this uninstaller:
http://www.outerinfo.com/OiUninstaller.exe

Tutorial for the uninstaller if needed

Reboot when done and delete this folder if found:
C:\Program Files\PurityScan

__________________
Stalking and killing Spyware

Have we helped you? Please consider a donation to help keep D-A-L free. Click on donate below



MALWARE: READ FIRST Procedures:
|_ SpyBot V1.5 _|_ HijackThis Log __V2.0.2 _|



ASAP: promoting a high standard and quality of security support no matter where you seek help.