Random popups after windows message alert (errorprotector, drivecleaner 2006, winantiviruspro)

Hey everyone

 

I'v got two serious problems and I got the impression this is the place with the most experts

 

The first one is, when I'm using IE, out of nowhere a message(OK/Cancel) pops "recommending" me download some programs blablabla

I click cancel and after some seconds a new IE window opens with some commercial for errorprotector/drivecleaner 2006/winantiviruspro or wtvr...

 

The other problem is, also randomly browsing the web, sometimes, after click a link (any link) theres a new window that opens with some three PHP scripting errors or something:

 

Warning: Invalid argument supplied for foreach() in /usr/local/www/data-dist/trafc-2/advdb/lmts.php on line 142

Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/data-dist/trafc-2/advdb/lmts.php:142) in /usr/local/www/data-dist/trafc-2/utl.php on line 129

Warning: Cannot modify header information - headers already sent by (output started at /usr/local/www/data-dist/trafc-2/advdb/lmts.php:142) in /usr/local/www/data-dist/trafc-2/utl.php on line 147

it's URL is:

http://89.188.16.10/trafc-2/rfe.php?cmp=vm_mg_old&nid=ik&lid=com&uid=249c2b58063211dc9342003048895bfc&guid=4c756c52+7b5aa7314c3c484ba1ae36908c96f62e&affid=67308&url=http:%2F%2Fwww.google.com%2Fsearch%3Fsourceid=navclient%26aq=t%26ie=UTF-8%26rlz=1T4GFRC_enIL217IL217%26q=%2fusr%2flocal%2fwww%2fdata%2ddist%2ftrafc%2d2%2fadvdb%2flmts%2ephp

 

 

Now, I'v been doing all I can to get rid of those and I usually succeed but this one is over me, there are no processes in TaskManager, no files, no nothing

 

 

HJT Log:

 

 

Logfile of HijackThis v1.99.1
Scan saved at 13:21:53, on 23/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Sygate\SPF\smc.exe
d:\Program Files\WindowBlinds\wbload.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Babylon\Babylon.exe
D:\Program Files\AntiVir PersonalEdition Classic\sched.exe
D:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\ATKKBService.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\System32\nvsvc32.exe
D:\Program Files\ICQ\Icq.exe
C:\Program Files\Windows Media Player\wmplayer.exe
D:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Program Files\HijackThis\HijackThis.exe

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SmcService] D:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Babylon Client] d:\Program Files\Babylon\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [avgnt] "D:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [setup] rundll32.exe "C:\WINDOWS\system32\dunuauvi.dll",realset
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &יצא ל- Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Download with GetRight - D:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - D:\Program Files\GetRight\GRbrowse.htm
O8 - Extra context menu item: מגיבריש לעברית - C:\Program Files\EitanRousso\Gibrish2Heb.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1\bin\npjpi141.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1\bin\npjpi141.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - D:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - D:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: מחקר - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1175902710529
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - D:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - D:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - D:\Program Files\Sygate\SPF\smc.exe

 

 

Many thanks for any help!

 

Ben.