Yea I need some help I've run spybot, adaware, and norton. I have a hijack log if you want to see it then ask.

Still however, I leave my comp and come back to find the same pop ups everytime.

Why don't you get google tool bar it might just finish off the rest of those pop ups for yah.. it's build into the browser. try it out.

what OS are you running?

windows xp

post you log .

Logfile of HijackThis v1.97.7
Scan saved at 6:23:05 PM, on 2/25/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

O4 - HKCU\..\Run: [Lerm] C:\Documents and Settings\Steven\Application Data\cacp.exe
O4 - HKCU\..\Run: [WNST] C:\WINDOWS\System32\wnsapisv.exe

what kind of popups are they . 2 things in you log that look suspicious

O4 - HKCU\..\Run: [Lerm] C:\Documents and Settings\Steven\Application Data\cacp.exe
O4 - HKCU\..\Run: [WNST] C:\WINDOWS\System32\wnsapisv.exe
can't find any info on them and that makes them suspicious,do you ahve any idea what they are

CACP.EXE is OK, I checked it out earlier. wnsapisv.exe is suspect, however. I have not found anything by searching on it and the filename sounds a bit dangerous.

At the very least, you should download and run the following utilities from Gibson Research: DCOMbob.exe, ShootTheMessenger.exe, and uPNP.exe. The first one shuts off the DCOM/RPC function that Blaster/Nachi/Welchia uses to infect systems, the second shuts off the Messenger service (which is not the same as AIM, MSN Messenger. or Yahoo! Messenger) to prevent spam pop-ups (and is likely giving you your problems), and the third turns off Universal Plug-and-Play, a security risk. All of these procedures are reversible, of course.

Well there are two pop ups I keep seeing one is a window that says "Stop Pop Ups!" also i get a lot of those promtps to install somthing/trust this company? Sometimes I get the right click menu of the desktop, then sometimes they are just blank windows with an address. Some of these will let me copy their shortcuts. Then i get the generic advertising ones also. It seems like there is a "set" of these pages b/c after so long they repeat

I ran unplugandplay but not dcom b/c i wanted to let you know im on a campus network and is it still a good idea? The shootmessanger said mine was already disabled also.

P.S. I've uploaded two text files, a list of my start ups, and a list of running processes. A couple of the names are unfamilar to me (carpserv.exe, ccApp.exe, ccEvtMgr.exe, csrss.exe, and lsass.exe)

P.S.S. this is in my prefetch PURITYSCAN.EXE-0299F40C.pf
it is installed onmy comp, i opened it and used the link it provided to uninstall it, says it was uninstalled but there's still a folder and that ^ file (i dont recall downloading PURITY SCAN

Those are all good windows files .the carpserve one is associated with your a Zoltrix modem ,ccApp.exe ,and ccEvtMgr.exe are norton ,csrss.exe is client server releated .lsass.exe is legit system file ,but some can be virus releated if they are in the wrong folder,it gets complicated !!.If you are worried about viruses run a online virus scan .
http://housecall.trendmicro.com/

And this [popups about popup and how to get rid of them .]can be stopped by getting stop the messenger fro the GRC site mentioned in TallCool1 post