Inundated with pop ups. HJT log attached. Please, please help

[erichswanson]

Hi all,

I'm at my wits end. I'm a fairly experienced user, but after Adaware, Spybot S&D and Spyware Doctor have run updated full scans, I'm still getting hit with pop up after pop up. Spyware Doctor finds and fixes the same problems everytime it runs (after a restart, anyway). Can someone please take a look at my logs and let me know what I can do to get this to stop? I REALLY don't want to have to wipe the drive and start over...

Thanks!
...erich

 

[RealBlackStuff]

Do this first:
See Broken Internet access with xxx.dll.
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll

Then Read: Only use these HJT-instructions when asked!
No /P//S/R/U/ ACTIONS FOR YOU.
Transfer the text from between these dotted lines underneath to between the dotted lines of that post.
Make sure to follow ALL instructions in SEQUENCE, and in HiJackThis tick/fix ALL lines indicated here!
...................................................................................................
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,
O4 - Global Startup: VPN Dialer (OnStartup).lnk = ?
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.edgesuite.net/dlmanager/versions/activex/dlm-activex-2.0.3.1.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
If Colorado SuperNet is your ISP, they are OK, otherwise FIX these O17s.
O17 - HKLM\System\CCS\Services\Tcpip\..\{1866DC28-818A-4894-891D-02B90B57350E}: NameServer = 205.171.3.65,205.171.2.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{79ED89BB-4725-49DD-9D68-30EA975EA09D}: NameServer = 205.171.3.65,205.171.2.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{D18E0E97-FC91-41AE-862A-D87496010B55}: NameServer = 205.171.2.65,205.171.3.65
O17 - HKLM\System\CS1\Services\Tcpip\..\{1866DC28-818A-4894-891D-02B90B57350E}: NameServer = 205.171.3.65,205.171.2.65
...................................................................................................

STOP using that crappy IE (other than for Windows-updates) and install Firefox from www.getfirefox.com

 

[erichswanson]

Still getting pop-up ads

Hi, and thanks so much for your help.

Unfortuantely, I'm still getting pop up windows. Can you take another look at my HJT log (attached).

Thanks again.

Oh, and the O17 entry is a custom DNS setting for my Qwest DSL service; can't surf without it...

 

[RealBlackStuff]

Try Read: How to remove Trojans and its ilk!

The log is clean.