Tech Support Forum - View Single Post

**Detah** · 10-22-2004, 07:16 AM

Let's do this in order.
----------------------------------------------------------------
Manually turn off Popups
Start | Run | type "services.msc" | rightclick Messenger | select Stop. then select Properties | under Startup Type, set to Disabled. OK OK. Reboot.
----------------------------------------------------------------
Now see if you can download and install AdAware. AdAware does a very fine job of cleaning up popup attackers.
----------------------------------------------------------------
Please do not attempt to fix or clean anything with HiJackThis on your own. Most of the items in a HiJackThis scan are required for your operating system to function normally. Only use HiJackThis under the guidance of an expert.
----------------------------------------------------------------
A Firewall technically does not block popups. A firewall's job is to monitor inbound and outbound traffic over all ports (ie. your dialup internet connection, ftp, telnet, etc). I would definitely recommend a firewall to you. But lets get the bugs out of your system first, then I would be glad to tackle the firewall issue with you.

I also want you to download and install Spybot Search & Destroy. Both programs scan your harddrive and remove spyware/adware/malware.

Here are my explicit AdAware and Spybot instructions.
When you are done please post a fresh HiJackThis log.
----------------------------------------------------------------
Here are two essential anti-spyware programs which you should run regularly. Updates for these programs come out weekly. Run them now.

Spybot Search & Destroy instructions (~3.5MB)

Download Spybot (written by Patrick Kolla). Click <download> from
http://www.safer-networking.org/
Save spybotsd13.exe into its own directory, NOT in a TEMPorary folder or on the Desktop.
I recommend c:/program files/spybot/
Doubleclick spybotsd13.exe. Make sure to direct the program to install in the c:/program files/spybot/ directory, NOT the default directory.
Open Spybot from Start | Programs | Spybot | Spybot S&D
Select <Search for Updates>. Let it install all updates. This is very important!
Select <Immunize>
Select <Check for Problems>
Check all entries that are in RED. Only RED, NOTHING ELSE. For your records, write/print out each item that you have fixed. Date it.
Select <Fix Selected Problems>
Close Spybot//

Ad-Aware instructions (2563 kB)

Download Ad-Aware SE build 1.05 (written by Lavasoft) from
http://www.lavasoft.de/
If you have a previous version of AdAware installed, you will be prompted to uninstall or keep the older version during installation. Be sure to choose Uninstall The Previous Version. Save aawsepersonal.exe into its own directory, NOT in a TEMPorary folder or on the Desktop. I recommend c:/program files/Adaware/
Doubleclick aawsepersonal.exe. Make sure to direct the program to install in the c:/program files/adaware/ directory, NOT the default directory.
Open AdAware from Start | Programs | Lavasoft | Adaware.
Select <Check for updates now>, <Proceed>
Setting adjustments. [[Green = checked]] Click the Gear Icon in the top right corner. New settings:
- By default you begin in the <General> section. The following should be checked:
  - Automatically save logfile
  - Automatically quarantine objects prior to removal
  - Safe Mode (always request confirmation)
  - Prompt to update outdated confirmation - change to "7 days"
- Click <Scanning>
  - Check Scan within Archives
  - Select "Select drives & folders to scan", check all of your harddrives. Usually its just c:/, <Proceed>
  - Under Memory & Registry, select all options
- Click <Advanced>
  - Under Shell Integration, select "Move deleted files to Recycle Bin"
  - Under Logfile detail, select all options
- Click <Defaults>
  - Type in the full URL of what you want as your default homepage and search page eg. http://www.google.com
- Click <Tweak>
  - Expand Scanning Engine and make sure the following are selected:
    - Unload recognized processes during scanning
    - Obtain command line of scanned processes
    - Scan registry for all users instead of current user only
  - Expand Cleaning Engine and make sure the following are selected:
    - Always try to unload modules before deletion
    - During removal, unload explorer and IE if necessary
    - Let Windows remove files in use at next reboot
    - Delete quarantined objects after restoring
  - Expand Safety Settings and make sure the following are selected:
    - Write-protect system files after repair (Hosts file, etc)
Click <Proceed> | <Start> | select Use custom scanning options | <Next>
When the scan is finished, rightclick on any entry and choose <Select All Objects>.
Select <Clean>
Close Adaware//

10-22-2004, 07:16 AM	#11 (permalink)
Detah TSF Enthusiast Join Date: Jun 2004 Location: from IL; now in KY Posts: 642 OS: Win98SE/XP My System	Let's do this in order. ---------------------------------------------------------------- Manually turn off Popups Start \| Run \| type "services.msc" \| rightclick Messenger \| select Stop. then select Properties \| under Startup Type, set to Disabled. OK OK. Reboot. ---------------------------------------------------------------- Now see if you can download and install AdAware. AdAware does a very fine job of cleaning up popup attackers. ---------------------------------------------------------------- Please do not attempt to fix or clean anything with HiJackThis on your own. Most of the items in a HiJackThis scan are required for your operating system to function normally. Only use HiJackThis under the guidance of an expert. ---------------------------------------------------------------- A Firewall technically does not block popups. A firewall's job is to monitor inbound and outbound traffic over all ports (ie. your dialup internet connection, ftp, telnet, etc). I would definitely recommend a firewall to you. But lets get the bugs out of your system first, then I would be glad to tackle the firewall issue with you. I also want you to download and install Spybot Search & Destroy. Both programs scan your harddrive and remove spyware/adware/malware. Here are my explicit AdAware and Spybot instructions. When you are done please post a fresh HiJackThis log. ---------------------------------------------------------------- Here are two essential anti-spyware programs which you should run regularly. Updates for these programs come out weekly. Run them now. Spybot Search & Destroy instructions (~3.5MB) Download Spybot (written by Patrick Kolla). Click <download> from http://www.safer-networking.org/ Save spybotsd13.exe into its own directory, NOT in a TEMPorary folder or on the Desktop. I recommend c:/program files/spybot/ Doubleclick spybotsd13.exe. Make sure to direct the program to install in the c:/program files/spybot/ directory, NOT the default directory. Open Spybot from Start \| Programs \| Spybot \| Spybot S&D Select <Search for Updates>. Let it install all updates. This is very important! Select <Immunize> Select <Check for Problems> Check all entries that are in RED. Only RED, NOTHING ELSE. For your records, write/print out each item that you have fixed. Date it. Select <Fix Selected Problems> Close Spybot// Ad-Aware instructions (2563 kB) Download Ad-Aware SE build 1.05 (written by Lavasoft) from http://www.lavasoft.de/ If you have a previous version of AdAware installed, you will be prompted to uninstall or keep the older version during installation. Be sure to choose Uninstall The Previous Version. Save aawsepersonal.exe into its own directory, NOT in a TEMPorary folder or on the Desktop. I recommend c:/program files/Adaware/ Doubleclick aawsepersonal.exe. Make sure to direct the program to install in the c:/program files/adaware/ directory, NOT the default directory. Open AdAware from Start \| Programs \| Lavasoft \| Adaware. Select <Check for updates now>, <Proceed> Setting adjustments. [[Green = checked]] Click the Gear Icon in the top right corner. New settings: By default you begin in the <General> section. The following should be checked: Automatically save logfile Automatically quarantine objects prior to removal Safe Mode (always request confirmation) Prompt to update outdated confirmation - change to "7 days" Click <Scanning> Check Scan within Archives Select "Select drives & folders to scan", check all of your harddrives. Usually its just c:/, <Proceed> Under Memory & Registry, select all options Click <Advanced> Under Shell Integration, select "Move deleted files to Recycle Bin" Under Logfile detail, select all options Click <Defaults> Type in the full URL of what you want as your default homepage and search page eg. http://www.google.com Click <Tweak> Expand Scanning Engine and make sure the following are selected: Unload recognized processes during scanning Obtain command line of scanned processes Scan registry for all users instead of current user only Expand Cleaning Engine and make sure the following are selected: Always try to unload modules before deletion During removal, unload explorer and IE if necessary Let Windows remove files in use at next reboot Delete quarantined objects after restoring Expand Safety Settings and make sure the following are selected: Write-protect system files after repair (Hosts file, etc) Click <Proceed> \| <Start> \| select Use custom scanning options \| <Next> When the scan is finished, rightclick on any entry and choose <Select All Objects>. Select <Clean> Close Adaware// Last edited by Detah : 10-22-2004 at 07:17 AM.