Oh man I'm haveing trouble again!!!

It sounds like your system is infected with some form of malware.

Download, install, update and run Ad-Aware and Spybot as described in this article. Be sure to configure Ad-Aware as described in the article!

If the problem still isn't resolved, download HijackThis, a malware analysis and removal tool, and submit the log it produces for analysis.

With the Windows Explorer, go to C:\, right click and create a folder named HJT. Unzip HijackThis.zip into the newly created directory, C:\HJT.

After installing HijackThis.exe in the directory C:\HJT, run Hijackthis from that directory. Click on the 'scan' button and then 'save log' button. Save the file in the directory C:\HJT. Use a name like HijackThis.txt.

Copy and paste the contents of the log you saved in a new message in the Virus and Trojan Removals board at TomCoyote.org for review by certified volunteer experts. Registration is required before posting. Be sure to describe the problem you're experiencing. DON'T ATTEMPT TO FIX ANYTHING REPORTED BY HIJACKTHIS without expert advice!

There are lots more people with malware problems they haven't been able to resolve than there are expert HijackThis analysts, so please be patient. See this post by ChrisRLG for other sites available for analyzing your HijackThis log.

Jim

Run the spyware removers as suggested.  Make sure both Ad-Aware and Spybot Search and Destroy are using the most current definitions.

P.S.  What kind of ROTAX power are you running?  Where are you from?

Thanks, I did run Adaware 6.0, and spybot with no change. So here is my hijack his file!

ogfile of HijackThis v1.98.2
Scan saved at 7:32:14 PM, on 8/28/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\System32\pctspk.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Kevin\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.heretofind.com/show.php?id=18&q=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.f150online.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.heretofind.com/show.php?id=18&q=%s
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = mk:@MSITStore:C:\spe\start.chm::/start.html#
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O9 - Extra button: Corel Network monitor worker - {0094C56A-0617-4DCE-8C0B-1248A0A01052} - (no file)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {0094C56A-0617-4DCE-8C0B-1248A0A01052} - (no file)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4

 

thanks guys/gals!

P.S. the Rotaxpower is in a SKI-DOO!

ROTAXPOWER,

Two items...

First, you haven't installed HijackThis.exe in a permanent directory, as I described in my earlier note. That's important, since if you're advised to repair things with HijackThis, it creates a backup of what's removed - in the directory it's installed in.

Second, also discussed in my earlier post, you should pick one of the sites listed to post your log. Trained help is available from several sites.

Jim

Bummer on the Ad-Aware and Spybot...  I've never used Hijackthis so someone else is going to have to field that one.

I knew the ROTAX was in a Ski-doo, I was curious as to what kind of Ski-doo!  I'm currently a Polaris man myself but I'd take a Doo.  Just too poor!

Thanks guys, the ski-doo is a 99 MXZ 600! gotta love 'em!

Ahhhh the good ole '99 MXZ 600s!  I've run into a few of those with my '00 XC 500 SP.  Talk about a sparky engine, I love my little 5-0!!!  Where do you run?

I'm from southern Sask. The great white north!