need help w/ browser (i'm new)

Unknown

hello all!

well i have a problem with my browser and it keeps taking me to some homepage res://brrgi.dll/index.html#37049 and it won't let me change it. it also keeps on showing all of these pop up ads about spyware. i came to the forum and looked at other people's problems and i tried downloading HijackThis, CWShredder, Spybot, ad-aware...but nothing is working. here is my log from hijack...

Logfile of HijackThis v1.97.7
Scan saved at 3:06:41 PM, on 6/24/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\d3rs.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\documents and settings\ryan\qttask.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\atlex.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Ryan\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\brrgi.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://brrgi.dll/index.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://brrgi.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\brrgi.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://brrgi.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\brrgi.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr6/*http://www.yahoo.com
O2 - BHO: (no name) - {6261A424-B0FC-0029-57C0-677FD04E086B} - C:\WINDOWS\sysdb32.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-us\msntb.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll (file missing)
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [Winsock2 driver] IEXPLORE.EXE
O4 - HKLM\..\Run: [sr1exe] "C:\Documents and Settings\All Users\Application Data\Dell\Alert\252\updtSup3.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\documents and settings\ryan\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch
O4 - HKLM\..\Run: [atlex.exe] C:\WINDOWS\system32\atlex.exe
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [SpyKiller] C:\Documents and Settings\Ryan\My Documents\SpyKiller\spykiller.exe /startup
O4 - HKLM\..\RunOnce: [atlzd.exe] C:\WINDOWS\atlzd.exe
O4 - HKLM\..\RunOnce: [ipni32.exe] C:\WINDOWS\ipni32.exe
O4 - HKLM\..\RunOnce: [d3rs.exe] C:\WINDOWS\d3rs.exe
O4 - HKLM\..\RunOnce: [appkl.exe] C:\WINDOWS\system32\appkl.exe
O4 - HKLM\..\RunOnce: [sysps32.exe] C:\WINDOWS\sysps32.exe
O4 - HKLM\..\RunOnce: [mfcbs32.exe] C:\WINDOWS\mfcbs32.exe
O4 - HKLM\..\RunOnce: [appjk.exe] C:\WINDOWS\appjk.exe
O4 - HKLM\..\RunOnce: [iekn32.exe] C:\WINDOWS\iekn32.exe
O4 - HKLM\..\RunOnce: [apiug32.exe] C:\WINDOWS\apiug32.exe
O4 - HKLM\..\RunOnce: [javaeh32.exe] C:\WINDOWS\system32\javaeh32.exe
O4 - HKLM\..\RunOnce: [addde.exe] C:\WINDOWS\addde.exe
O4 - HKLM\..\RunOnce: [apphr32.exe] C:\WINDOWS\apphr32.exe
O4 - HKLM\..\RunOnce: [apifz32.exe] C:\WINDOWS\apifz32.exe
O4 - HKLM\..\RunOnce: [atlba32.exe] C:\WINDOWS\system32\atlba32.exe
O4 - HKLM\..\RunOnce: [mswx32.exe] C:\WINDOWS\mswx32.exe
O4 - HKLM\..\RunOnce: [d3dm32.exe] C:\WINDOWS\d3dm32.exe
O4 - HKLM\..\RunOnce: [apixc.exe] C:\WINDOWS\apixc.exe
O4 - HKLM\..\RunOnce: [sdkxt.exe] C:\WINDOWS\system32\sdkxt.exe
O4 - HKLM\..\RunOnce: [ipoj32.exe] C:\WINDOWS\system32\ipoj32.exe
O4 - HKLM\..\RunOnce: [apiec.exe] C:\WINDOWS\apiec.exe
O4 - HKLM\..\RunOnce: [netpv.exe] C:\WINDOWS\system32\netpv.exe
O4 - HKLM\..\RunOnce: [d3yf.exe] C:\WINDOWS\system32\d3yf.exe
O4 - HKLM\..\RunOnce: [javaey32.exe] C:\WINDOWS\javaey32.exe
O4 - HKLM\..\RunOnce: [atliz.exe] C:\WINDOWS\system32\atliz.exe
O4 - HKLM\..\RunOnce: [d3gd32.exe] C:\WINDOWS\system32\d3gd32.exe
O4 - HKLM\..\RunOnce: [ieem32.exe] C:\WINDOWS\ieem32.exe
O4 - HKLM\..\RunOnce: [addpn.exe] C:\WINDOWS\addpn.exe
O4 - HKLM\..\RunOnce: [sysuq.exe] C:\WINDOWS\system32\sysuq.exe
O4 - HKLM\..\RunOnce: [d3tl.exe] C:\WINDOWS\d3tl.exe
O4 - HKLM\..\RunOnce: [javasr.exe] C:\WINDOWS\javasr.exe
O4 - HKLM\..\RunOnce: [javawk.exe] C:\WINDOWS\javawk.exe
O4 - HKLM\..\RunOnce: [sysez32.exe] C:\WINDOWS\sysez32.exe
O4 - HKLM\..\RunOnce: [atlyt.exe] C:\WINDOWS\system32\atlyt.exe
O4 - HKLM\..\RunOnce: [crsc32.exe] C:\WINDOWS\crsc32.exe
O4 - HKLM\..\RunOnce: [javaad32.exe] C:\WINDOWS\javaad32.exe
O4 - HKLM\..\RunOnce: [ntqb32.exe] C:\WINDOWS\ntqb32.exe
O4 - HKLM\..\RunOnce: [winfg.exe] C:\WINDOWS\winfg.exe
O4 - HKLM\..\RunOnce: [mfcon32.exe] C:\WINDOWS\system32\mfcon32.exe
O4 - HKLM\..\RunOnce: [ipuv32.exe] C:\WINDOWS\system32\ipuv32.exe
O4 - HKLM\..\RunOnce: [iegf32.exe] C:\WINDOWS\system32\iegf32.exe
O4 - HKLM\..\RunOnce: [apiwy.exe] C:\WINDOWS\system32\apiwy.exe
O4 - HKLM\..\RunOnce: [sdkmx32.exe] C:\WINDOWS\system32\sdkmx32.exe
O4 - HKLM\..\RunOnce: [apikc.exe] C:\WINDOWS\apikc.exe
O4 - HKLM\..\RunOnce: [apioj.exe] C:\WINDOWS\system32\apioj.exe
O4 - HKLM\..\RunOnce: [ipop.exe] C:\WINDOWS\ipop.exe
O4 - HKLM\..\RunOnce: [mfcna32.exe] C:\WINDOWS\system32\mfcna32.exe
O4 - HKLM\..\RunOnce: [ipch.exe] C:\WINDOWS\system32\ipch.exe
O4 - HKLM\..\RunOnce: [netpn.exe] C:\WINDOWS\netpn.exe
O4 - HKLM\..\RunOnce: [d3uh32.exe] C:\WINDOWS\d3uh32.exe
O4 - HKLM\..\RunOnce: [apiky32.exe] C:\WINDOWS\apiky32.exe
O4 - HKLM\..\RunOnce: [ipxc.exe] C:\WINDOWS\system32\ipxc.exe
O4 - HKLM\..\RunOnce: [apprd.exe] C:\WINDOWS\apprd.exe
O4 - HKLM\..\RunOnce: [apihn.exe] C:\WINDOWS\apihn.exe
O4 - HKLM\..\RunOnce: [javarj32.exe] C:\WINDOWS\system32\javarj32.exe
O4 - HKLM\..\RunOnce: [msty.exe] C:\WINDOWS\msty.exe
O4 - HKLM\..\RunOnce: [d3rp.exe] C:\WINDOWS\d3rp.exe
O4 - HKLM\..\RunOnce: [javaif.exe] C:\WINDOWS\javaif.exe
O4 - HKLM\..\RunOnce: [ntqa32.exe] C:\WINDOWS\system32\ntqa32.exe
O4 - HKLM\..\RunOnce: [atldu.exe] C:\WINDOWS\system32\atldu.exe
O4 - HKLM\..\RunOnce: [iple.exe] C:\WINDOWS\iple.exe
O4 - HKLM\..\RunOnce: [d3ur.exe] C:\WINDOWS\d3ur.exe
O4 - HKLM\..\RunOnce: [ntpr32.exe] C:\WINDOWS\system32\ntpr32.exe
O4 - HKLM\..\RunOnce: [ieos32.exe] C:\WINDOWS\ieos32.exe
O4 - HKLM\..\RunOnce: [addap.exe] C:\WINDOWS\system32\addap.exe
O4 - HKLM\..\RunOnce: [apifr.exe] C:\WINDOWS\system32\apifr.exe
O4 - HKLM\..\RunOnce: [javarr32.exe] C:\WINDOWS\system32\javarr32.exe
O4 - HKLM\..\RunOnce: [sdkqz.exe] C:\WINDOWS\system32\sdkqz.exe
O4 - HKLM\..\RunOnce: [sysbk32.exe] C:\WINDOWS\sysbk32.exe
O4 - HKLM\..\RunOnce: [javahm.exe] C:\WINDOWS\system32\javahm.exe
O4 - HKLM\..\RunOnce: [javayp.exe] C:\WINDOWS\system32\javayp.exe
O4 - HKLM\..\RunOnce: [crgy.exe] C:\WINDOWS\crgy.exe
O4 - HKLM\..\RunOnce: [netyv.exe] C:\WINDOWS\netyv.exe
O4 - HKLM\..\RunOnce: [msgq.exe] C:\WINDOWS\msgq.exe
O4 - HKLM\..\RunOnce: [appnp.exe] C:\WINDOWS\appnp.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: WeatherBug (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/games/clients/y/et1_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potd_x.cab
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://208.158.118.13/AxisCamControl.ocx
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

please help me....!

Thrax

Boot into safe mode and delete all of these with hijackthis.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\brrgi.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://brrgi.dll/index.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://brrgi.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\brrgi.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://brrgi.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\brrgi.dll/sp.html#37049
O2 - BHO: (no name) - {6261A424-B0FC-0029-57C0-677FD04E086B} - C:\WINDOWS\sysdb32.dll
O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch
O4 - HKLM\..\Run: [atlex.exe] C:\WINDOWS\system32\atlex.exe
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKLM\..\RunOnce: [atlzd.exe] C:\WINDOWS\atlzd.exe
O4 - HKLM\..\RunOnce: [ipni32.exe] C:\WINDOWS\ipni32.exe
O4 - HKLM\..\RunOnce: [d3rs.exe] C:\WINDOWS\d3rs.exe
O4 - HKLM\..\RunOnce: [appkl.exe] C:\WINDOWS\system32\appkl.exe
O4 - HKLM\..\RunOnce: [sysps32.exe] C:\WINDOWS\sysps32.exe
O4 - HKLM\..\RunOnce: [mfcbs32.exe] C:\WINDOWS\mfcbs32.exe
O4 - HKLM\..\RunOnce: [appjk.exe] C:\WINDOWS\appjk.exe
O4 - HKLM\..\RunOnce: [iekn32.exe] C:\WINDOWS\iekn32.exe
O4 - HKLM\..\RunOnce: [apiug32.exe] C:\WINDOWS\apiug32.exe
O4 - HKLM\..\RunOnce: [javaeh32.exe] C:\WINDOWS\system32\javaeh32.exe
O4 - HKLM\..\RunOnce: [addde.exe] C:\WINDOWS\addde.exe
O4 - HKLM\..\RunOnce: [apphr32.exe] C:\WINDOWS\apphr32.exe
O4 - HKLM\..\RunOnce: [apifz32.exe] C:\WINDOWS\apifz32.exe
O4 - HKLM\..\RunOnce: [atlba32.exe] C:\WINDOWS\system32\atlba32.exe
O4 - HKLM\..\RunOnce: [mswx32.exe] C:\WINDOWS\mswx32.exe
O4 - HKLM\..\RunOnce: [d3dm32.exe] C:\WINDOWS\d3dm32.exe
O4 - HKLM\..\RunOnce: [apixc.exe] C:\WINDOWS\apixc.exe
O4 - HKLM\..\RunOnce: [sdkxt.exe] C:\WINDOWS\system32\sdkxt.exe
O4 - HKLM\..\RunOnce: [ipoj32.exe] C:\WINDOWS\system32\ipoj32.exe
O4 - HKLM\..\RunOnce: [apiec.exe] C:\WINDOWS\apiec.exe
O4 - HKLM\..\RunOnce: [netpv.exe] C:\WINDOWS\system32\netpv.exe
O4 - HKLM\..\RunOnce: [d3yf.exe] C:\WINDOWS\system32\d3yf.exe
O4 - HKLM\..\RunOnce: [javaey32.exe] C:\WINDOWS\javaey32.exe
O4 - HKLM\..\RunOnce: [atliz.exe] C:\WINDOWS\system32\atliz.exe
O4 - HKLM\..\RunOnce: [d3gd32.exe] C:\WINDOWS\system32\d3gd32.exe
O4 - HKLM\..\RunOnce: [ieem32.exe] C:\WINDOWS\ieem32.exe
O4 - HKLM\..\RunOnce: [addpn.exe] C:\WINDOWS\addpn.exe
O4 - HKLM\..\RunOnce: [sysuq.exe] C:\WINDOWS\system32\sysuq.exe
O4 - HKLM\..\RunOnce: [d3tl.exe] C:\WINDOWS\d3tl.exe
O4 - HKLM\..\RunOnce: [javasr.exe] C:\WINDOWS\javasr.exe
O4 - HKLM\..\RunOnce: [javawk.exe] C:\WINDOWS\javawk.exe
O4 - HKLM\..\RunOnce: [sysez32.exe] C:\WINDOWS\sysez32.exe
O4 - HKLM\..\RunOnce: [atlyt.exe] C:\WINDOWS\system32\atlyt.exe
O4 - HKLM\..\RunOnce: [crsc32.exe] C:\WINDOWS\crsc32.exe
O4 - HKLM\..\RunOnce: [javaad32.exe] C:\WINDOWS\javaad32.exe
O4 - HKLM\..\RunOnce: [ntqb32.exe] C:\WINDOWS\ntqb32.exe
O4 - HKLM\..\RunOnce: [winfg.exe] C:\WINDOWS\winfg.exe
O4 - HKLM\..\RunOnce: [mfcon32.exe] C:\WINDOWS\system32\mfcon32.exe
O4 - HKLM\..\RunOnce: [ipuv32.exe] C:\WINDOWS\system32\ipuv32.exe
O4 - HKLM\..\RunOnce: [iegf32.exe] C:\WINDOWS\system32\iegf32.exe
O4 - HKLM\..\RunOnce: [apiwy.exe] C:\WINDOWS\system32\apiwy.exe
O4 - HKLM\..\RunOnce: [sdkmx32.exe] C:\WINDOWS\system32\sdkmx32.exe
O4 - HKLM\..\RunOnce: [apikc.exe] C:\WINDOWS\apikc.exe
O4 - HKLM\..\RunOnce: [apioj.exe] C:\WINDOWS\system32\apioj.exe
O4 - HKLM\..\RunOnce: [ipop.exe] C:\WINDOWS\ipop.exe
O4 - HKLM\..\RunOnce: [mfcna32.exe] C:\WINDOWS\system32\mfcna32.exe
O4 - HKLM\..\RunOnce: [ipch.exe] C:\WINDOWS\system32\ipch.exe
O4 - HKLM\..\RunOnce: [netpn.exe] C:\WINDOWS\netpn.exe
O4 - HKLM\..\RunOnce: [d3uh32.exe] C:\WINDOWS\d3uh32.exe
O4 - HKLM\..\RunOnce: [apiky32.exe] C:\WINDOWS\apiky32.exe
O4 - HKLM\..\RunOnce: [ipxc.exe] C:\WINDOWS\system32\ipxc.exe
O4 - HKLM\..\RunOnce: [apprd.exe] C:\WINDOWS\apprd.exe
O4 - HKLM\..\RunOnce: [apihn.exe] C:\WINDOWS\apihn.exe
O4 - HKLM\..\RunOnce: [javarj32.exe] C:\WINDOWS\system32\javarj32.exe
O4 - HKLM\..\RunOnce: [msty.exe] C:\WINDOWS\msty.exe
O4 - HKLM\..\RunOnce: [d3rp.exe] C:\WINDOWS\d3rp.exe
O4 - HKLM\..\RunOnce: [javaif.exe] C:\WINDOWS\javaif.exe
O4 - HKLM\..\RunOnce: [ntqa32.exe] C:\WINDOWS\system32\ntqa32.exe
O4 - HKLM\..\RunOnce: [atldu.exe] C:\WINDOWS\system32\atldu.exe
O4 - HKLM\..\RunOnce: [iple.exe] C:\WINDOWS\iple.exe
O4 - HKLM\..\RunOnce: [d3ur.exe] C:\WINDOWS\d3ur.exe
O4 - HKLM\..\RunOnce: [ntpr32.exe] C:\WINDOWS\system32\ntpr32.exe
O4 - HKLM\..\RunOnce: [ieos32.exe] C:\WINDOWS\ieos32.exe
O4 - HKLM\..\RunOnce: [addap.exe] C:\WINDOWS\system32\addap.exe
O4 - HKLM\..\RunOnce: [apifr.exe] C:\WINDOWS\system32\apifr.exe
O4 - HKLM\..\RunOnce: [javarr32.exe] C:\WINDOWS\system32\javarr32.exe
O4 - HKLM\..\RunOnce: [sdkqz.exe] C:\WINDOWS\system32\sdkqz.exe
O4 - HKLM\..\RunOnce: [sysbk32.exe] C:\WINDOWS\sysbk32.exe
O4 - HKLM\..\RunOnce: [javahm.exe] C:\WINDOWS\system32\javahm.exe
O4 - HKLM\..\RunOnce: [javayp.exe] C:\WINDOWS\system32\javayp.exe
O4 - HKLM\..\RunOnce: [crgy.exe] C:\WINDOWS\crgy.exe
O4 - HKLM\..\RunOnce: [netyv.exe] C:\WINDOWS\netyv.exe
O4 - HKLM\..\RunOnce: [msgq.exe] C:\WINDOWS\msgq.exe
O4 - HKLM\..\RunOnce: [appnp.exe] C:\WINDOWS\appnp.exe
O9 - Extra button: WeatherBug (HKCU)

May I also suggest the uninstallation of Quicktime and Real Player in favor of Real Alternative and Quicktime Alternative.

You can also uninstall the MSN toolbar, unless you actually want it.

ryguy0623

alright, i've delated all of those that you mentioned but i still have the same old homepage w/ all of the pop ups about spyware....here is my new hijack...

Logfile of HijackThis v1.97.7
Scan saved at 3:55:03 PM, on 6/24/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\d3rs.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\documents and settings\ryan\qttask.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\atlex.exe
C:\Documents and Settings\Ryan\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\brrgi.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr6/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = iexplore
O2 - BHO: (no name) - {396EC13B-FBD5-7CB6-FBE2-8F3EF6279037} - C:\WINDOWS\crjj.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-us\msntb.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll (file missing)
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [Winsock2 driver] IEXPLORE.EXE
O4 - HKLM\..\Run: [sr1exe] "C:\Documents and Settings\All Users\Application Data\Dell\Alert\252\updtSup3.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\documents and settings\ryan\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [atlex.exe] C:\WINDOWS\system32\atlex.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [SpyKiller] C:\Documents and Settings\Ryan\My Documents\SpyKiller\spykiller.exe /startup
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: WeatherBug (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/games/clients/y/et1_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potd_x.cab
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://208.158.118.13/AxisCamControl.ocx
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Thrax

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\brrgi.dll/sp.html#37049
O2 - BHO: (no name) - {396EC13B-FBD5-7CB6-FBE2-8F3EF6279037} - C:\WINDOWS\crjj.dll
O4 - HKLM\..\Run: [atlex.exe] C:\WINDOWS\system32\atlex.exe
O9 - Extra button: WeatherBug (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

<font size=1 face=timesnewroman color=blue><i>Faster than Short-Media City's SVT SWAT Team, it's Super Thrax!</i></font>

[php]<delusionsofgrandeur></delusionsofgrandeur>[/php]

ryguy0623

i looked at it again and i forgot to delete one of them. i deleated it and now everything i working fine. thank you for helping!

Thrax

Good to see you're back in shape! Hope to see you around the forums.

ryguy0623

i'm having problems again and i don't know what is goin on. this is my log...

Logfile of HijackThis v1.97.7
Scan saved at 5:04:37 PM, on 6/24/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\d3rs.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\documents and settings\ryan\qttask.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\iedj.exe
C:\Documents and Settings\Ryan\Desktop\computer problems\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\edmwg.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://edmwg.dll/index.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://edmwg.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\edmwg.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://edmwg.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\edmwg.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr6/*http://www.yahoo.com
O2 - BHO: (no name) - {396EC13B-FBD5-7CB6-FBE2-8F3EF6279037} - C:\WINDOWS\crjj.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-us\msntb.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll (file missing)
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [Winsock2 driver] IEXPLORE.EXE
O4 - HKLM\..\Run: [sr1exe] "C:\Documents and Settings\All Users\Application Data\Dell\Alert\252\updtSup3.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\documents and settings\ryan\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [iedj.exe] C:\WINDOWS\system32\iedj.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [SpyKiller] C:\Documents and Settings\Ryan\My Documents\SpyKiller\spykiller.exe /startup
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Real.com (HKLM)
O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/games/clients/y/et1_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potd_x.cab
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://208.158.118.13/AxisCamControl.ocx
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab


i keep on deleating..
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\edmwg.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://edmwg.dll/index.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://edmwg.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\edmwg.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://edmwg.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\edmwg.dll/sp.html#37049
O2 - BHO: (no name) - {396EC13B-FBD5-7CB6-FBE2-8F3EF6279037} - C:\WINDOWS\crjj.dll

but they keep on commin back after i close out of my IE and open it up again. help me again please

Gobbles

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\edmwg.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://edmwg.dll/index.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://edmwg.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\edmwg.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://edmwg.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\edmwg.dll/sp.html#37049
O2 - BHO: (no name) - {396EC13B-FBD5-7CB6-FBE2-8F3EF6279037} - C:\WINDOWS\crjj.dll
O4 - HKLM\..\Run: [iedj.exe] C:\WINDOWS\system32\iedj.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yah...utocomplete.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52...meInstaller.exe

Id give those a go....

Gobbles

ryguy0623

hey thanks....it's workin for now. is there anything that i shouldn't do so that it won't end up goin back to the pop ups?

shwaip

restore this one, there's nothing wrong with it, and it is req'd if you want to play media in IE, IIRC:
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

As for prevention:
Keep track of what websites you visit. If you can narrow it down to what's causing the problem, don't return there.
Make sure you've got all the latest windows updates.

ryguy0623

all of those res:// files keep comming back. i keep on deleating them but it just doesn't seem to work. i just want to get rid of it because this is on a family computer and one of the pop-ups that keeps comming back is a window of a group of green ants in sexual positions saying the spyware is replicating. I want to get rid of it all so the younger ones don't see.

Kwitko

This variant of CWS is particularly nasty.

First make sure that you can view hidden and system files.

Go to Start>Run and type in services.msc. Find Network Security Service and double-click on it. Click on Disable then click OK. Close the Services window, then open the Task Manager and shut down iedj.exe and d3rs.exe by right-clicking on the process name then clicking End Process.

Next, restart HiJackThis and delete the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\edmwg.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://edmwg.dll/index.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://edmwg.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\edmwg.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://edmwg.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\edmwg.dll/sp.html#37049
O2 - BHO: (no name) - {396EC13B-FBD5-7CB6-FBE2-8F3EF6279037} - C:\WINDOWS\crjj.dll
O4 - HKLM\..\Run: [iedj.exe] C:\WINDOWS\system32\iedj.exe

Reboot and repost a fresh log.

ryguy0623

alright, here is my new log...

Logfile of HijackThis v1.97.7
Scan saved at 11:23:06 PM, on 6/24/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\d3rs.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\documents and settings\ryan\qttask.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Documents and Settings\Ryan\Desktop\computer problems\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr6/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = iexplore
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-us\msntb.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll (file missing)
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [Winsock2 driver] IEXPLORE.EXE
O4 - HKLM\..\Run: [sr1exe] "C:\Documents and Settings\All Users\Application Data\Dell\Alert\252\updtSup3.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\documents and settings\ryan\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKLM\..\RunOnce: [ipgd.exe] C:\WINDOWS\system32\ipgd.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Real.com (HKLM)
O16 - DPF: Yahoo! Euchre - http://download.games.yahoo.com/games/clients/y/et1_x.cab
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://208.158.118.13/AxisCamControl.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

but the res:// keep commin back

Kwitko

Strange, the res:// DLLs aren't showing up in your log. I think you're going to have to reset your homepage. Try setting a new site as your new home page. Restart IE and see if it sticks.

Kill this process:
C:\WINDOWS\d3rs.exe

Remove these entries:
O4 - HKLM\..\RunOnce: [ipgd.exe] C:\WINDOWS\system32\ipgd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\documents and settings\ryan\qttask.exe" -atboottime

About the cisvc.exe process, there's a chance that it's a keylogger. Follow the instructions at the bottom of this page.

Reboot and see if you're still getting randomly named processes. Also check if your new homepage stuck.

ryguy0623

hey i got rid of those files and changed my homepage, and everything was workin fine. but after a couple min. or so, the old res:// homepage showed up. it's gettin close....