Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 




Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > HijackThis Log Help > Resolved HJT Threads
Please Help- annoying pop-ups in IE Please Help- annoying pop-ups in IE
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read

Resolved HJT Threads Resolved spyware and popup issues.

 
 
Thread Tools
Old 10-23-2007, 11:19 PM   #1 (permalink)
Registered User
 
Join Date: Oct 2007
Posts: 4
OS: xp


Please Help- annoying pop-ups in IE
When i use IE as browser, I get infrequent but annoying popups. Sometimes there are three or four windows open after periods of
inactivity, even without internet use. It seems that the majority
of them are for winantivirus ads or publisher's clearing house. the last one's url was: http://paidmarketingpanel.aavalue.co...137799&affid=0

Thanks,

Luke

Panda Active Scan:
Incident Status Location

Virus:Trj/Downloader.QBW Disinfected Operating system
Spyware:Spyware/DuncanMonitor Not disinfected C:\WINDOWS\system32\CMDl32.dll
Potentially unwanted tool:application/regclean32 Not disinfected C:\Documents and Settings\Luke\Application Data\Registry Cleaner
Virus:Trj/Downloader.QBW Disinfected C:\Documents and Settings\Luke\Application Data\tmp110.tmp.exe
Virus:Trj/Downloader.QBW Disinfected C:\Documents and Settings\Luke\Application Data\tmp12.tmp.exe
Virus:Trj/Downloader.QBW Disinfected C:\Documents and Settings\Luke\Application Data\tmp13D.tmp.exe
Virus:Trj/Downloader.QBW Disinfected C:\Documents and Settings\Luke\Application Data\tmp14.tmp.exe
Adware:Adware/PopupSearches Not disinfected C:\Documents and Settings\Luke\Application Data\tmp16C.tmp.exe
Virus:Trj/Downloader.QBW Disinfected C:\Documents and Settings\Luke\Application Data\tmp17.tmp.exe
Virus:Trj/Downloader.QBW Disinfected C:\Documents and Settings\Luke\Application Data\tmp1C9.tmp.exe
Adware:Adware/PopupSearches Not disinfected C:\Documents and Settings\Luke\Application Data\tmp1DD.tmp.exe
Spyware:Spyware/Virtumonde Not disinfected C:\Documents and Settings\Luke\Application Data\tmp1DE.tmp.exe
Virus:Generic Trojan Disinfected C:\Documents and Settings\Luke\Application Data\tmp29.tmp.exe
Adware:Adware/PurityScan Not disinfected C:\Documents and Settings\Luke\Application Data\tmp2F0.tmp.exe
Virus:Trj/Downloader.QBW Disinfected C:\Documents and Settings\Luke\Application Data\tmp305.tmp.exe
Virus:Trj/Downloader.QBW Disinfected C:\Documents and Settings\Luke\Application Data\tmp357.tmp.exe
Virus:Trj/Downloader.QBW Disinfected C:\Documents and Settings\Luke\Application Data\tmp358.tmp.exe
Virus:Trj/Downloader.QBW Disinfected C:\Documents and Settings\Luke\Application Data\tmp44.tmp.exe
Virus:Trj/Downloader.QBW Disinfected C:\Documents and Settings\Luke\Application Data\tmp44C.tmp.exe
Virus:Trj/Downloader.PEC Disinfected C:\Documents and Settings\Luke\Application Data\tmp4B.tmp.exe
Virus:Trj/Lowzones.TP Disinfected C:\Documents and Settings\Luke\Application Data\tmp4C.tmp.exe
Virus:Trj/Downloader.QBW Disinfected C:\Documents and Settings\Luke\Application Data\tmp512.tmp.exe
Virus:Trj/Downloader.QBW Disinfected C:\Documents and Settings\Luke\Application Data\tmp518.tmp.exe
Virus:Generic Trojan Disinfected C:\Documents and Settings\Luke\Application Data\tmp65.tmp.exe
Virus:Trj/Lowzones.TP Disinfected C:\Documents and Settings\Luke\Application Data\tmp66.tmp.exe
Virus:Trj/Downloader.PEC Disinfected C:\Documents and Settings\Luke\Application Data\tmp7.tmp.exe
Virus:Trj/Downloader.QBW Disinfected C:\Documents and Settings\Luke\Application Data\tmp85.tmp.exe
Virus:Trj/Downloader.QBW Disinfected C:\Documents and Settings\Luke\Application Data\tmp91.tmp.exe
Virus:Trj/Downloader.QBW Disinfected C:\Documents and Settings\Luke\Application Data\tmpB4.tmp.exe
Virus:Generic Trojan Disinfected C:\Documents and Settings\Luke\Application Data\tmpBB.tmp.exe
Virus:Trj/Downloader.QBW Disinfected C:\Documents and Settings\Luke\Application Data\tmpC2.tmp.exe
Virus:Trj/Downloader.QBW Disinfected C:\Documents and Settings\Luke\Application Data\tmpE9.tmp.exe
Virus:Trj/Downloader.QBW Disinfected C:\Documents and Settings\Luke\Application Data\tmpEB.tmp.exe
Virus:Trj/Downloader.QBW Disinfected C:\Documents and Settings\Luke\Application Data\tmpF4.tmp.exe
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Luke\Cookies\luke@2o7[2].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Luke\Cookies\luke@ad.yieldmanager[1].txt
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Luke\Cookies\luke@adrevolver[1].txt
Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\Luke\Cookies\luke@ads.addynamix[1].txt
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Luke\Cookies\luke@ads.pointroll[2].txt
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Luke\Cookies\luke@advertising[1].txt
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Luke\Cookies\luke@apmebf[2].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Luke\Cookies\luke@atdmt[2].txt
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Luke\Cookies\luke@azjmp[1].txt
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Luke\Cookies\luke@bluestreak[2].txt
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Luke\Cookies\luke@bs.serving-sys[2].txt
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Luke\Cookies\luke@burstnet[1].txt
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Luke\Cookies\luke@casalemedia[2].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Luke\Cookies\luke@doubleclick[1].txt
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Luke\Cookies\luke@drivecleaner[2].txt
Spyware:Cookie/Enhance Not disinfected C:\Documents and Settings\Luke\Cookies\luke@enhance[2].txt
Spyware:Cookie/ErrorSafe Not disinfected C:\Documents and Settings\Luke\Cookies\luke@errorsafe[1].txt
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Luke\Cookies\luke@fastclick[1].txt
Spyware:Cookie/GoClick Not disinfected C:\Documents and Settings\Luke\Cookies\luke@goclick[2].txt
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Luke\Cookies\luke@media.adrevolver[3].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Luke\Cookies\luke@mediaplex[2].txt
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Luke\Cookies\luke@overture[1].txt
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Luke\Cookies\luke@questionmarket[1].txt
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Luke\Cookies\luke@realmedia[2].txt
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Luke\Cookies\luke@server.iad.liveperson[2].txt
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Luke\Cookies\luke@serving-sys[2].txt
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Luke\Cookies\luke@statcounter[1].txt
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Luke\Cookies\luke@stats.drivecleaner[1].txt
Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\Luke\Cookies\luke@stats1.reliablestats[2].txt
Spyware:Cookie/Systemdoctor Not disinfected C:\Documents and Settings\Luke\Cookies\luke@systemdoctor[2].txt
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Luke\Cookies\luke@trafficmp[1].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Luke\Cookies\luke@tribalfusion[1].txt
Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Luke\Cookies\luke@winantispyware[1].txt
Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Luke\Cookies\luke@winantivirus[1].txt
Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Luke\Cookies\luke@www.burstbeacon[1].txt
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Luke\Cookies\luke@www.drivecleaner[3].txt
Spyware:Cookie/Systemdoctor Not disinfected C:\Documents and Settings\Luke\Cookies\luke@www.systemdoctor[1].txt
Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Luke\Cookies\luke@www.winantivirus[2].txt
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Luke\Cookies\luke@zedo[2].txt
Virus:Trj/Downloader.QBW Disinfected C:\Documents and Settings\Luke\Local Settings\Temporary Internet Files\Content.IE5\5HIGQ1TZ\barsik[1]
Potentially unwanted tool:Application/Processor Not disinfected C:\RECYCLER\S-1-5-21-1454471165-746137067-1343024091-1004\Dc73.zip[SmitfraudFix/Process.exe]
Virus:Trj/Rebooter.J Disinfected C:\RECYCLER\S-1-5-21-1454471165-746137067-1343024091-1004\Dc73.zip[SmitfraudFix/Reboot.exe]
Potentially unwanted tool:Application/SuperFast Not disinfected C:\RECYCLER\S-1-5-21-1454471165-746137067-1343024091-1004\Dc73.zip[SmitfraudFix/restart.exe]
Potentially unwanted tool:Application/Processor Not disinfected C:\RECYCLER\S-1-5-21-1454471165-746137067-1343024091-1004\Dc75.exe
Virus:Trj/Rebooter.J Disinfected C:\RECYCLER\S-1-5-21-1454471165-746137067-1343024091-1004\Dc77.exe
Potentially unwanted tool:Application/SuperFast Not disinfected C:\RECYCLER\S-1-5-21-1454471165-746137067-1343024091-1004\Dc79.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\WINDOWS\system32\Process.exe
Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\tmp1DE.tmp.dll
Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\tmpF5.tmp.dll







Deckard's System Scanner v20071014.68
Run by Luke on 2007-10-24 00:00:39
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
28: 2007-10-13 08:18:49 UTC - RP491 - Windows Defender Checkpoint
27: 2007-10-12 08:14:27 UTC - RP490 - Windows Defender Checkpoint
26: 2007-10-12 07:21:04 UTC - RP489 - Software Distribution Service 3.0
25: 2007-10-11 08:12:39 UTC - RP488 - Windows Defender Checkpoint
24: 2007-10-10 20:12:42 UTC - RP487 - Software Distribution Service 3.0


-- First Restore Point --
1: 2007-09-22 15:39:52 UTC - RP464 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 384 MiB (512 MiB recommended).


-- HijackThis (run as Luke.exe) ------------------------------------------------

Unable to find log (file not found); running clone.
-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2007-10-24 00:03:27
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\AcroTray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Luke\Application Data\tmpF4.tmp.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Luke\Desktop\dss.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Link...ww.google.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://home.microsoft.com/access/autosearch.asp?p=%s
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\system32\tmpC1.tmp.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {da9bc17f-36cd-4e2e-8f5e-eac6bd678f23} - C:\WINDOWS\system32\CMDl32.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get...nt/swflash.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...59/mcfscan.cab
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
O20 - AppInit_DLLs: c:\windows\system32\fccbxvw.dll
O20 - Winlogon Notify: CMDl32 - C:\WINDOWS\system32\CMDl32.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: DomainService - Unknown owner - C:\Documents and Settings\Luke\Application Data\tmpF4.tmp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: RoxUPnPRenderer - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe


--
End of file - 7640 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R2 SBKUPNT - c:\windows\system32\drivers\sbkupnt.sys
R3 SS1020 (Siemens SpeedStream PCI 10/100 Win2000 Driver) - c:\windows\system32\drivers\ss1020n5.sys <Not Verified; Siemens; Siemens SpeedStream PCI 10/100>

S3 ossrv (Creative OS Services Driver) - c:\windows\system32\drivers\ctoss2k.sys (file missing)
S3 Pcouffin (Low level access layer for CD devices) - c:\windows\system32\drivers\pcouffin.sys (file missing)
S3 TVICHW32 - c:\windows\system32\drivers\tvichw32.sys <Not Verified; EnTech Taiwan; TVicHW32 Generic Device Driver for Windows 95/98/ME/NT/2000/2003/XP/XP64>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>
R2 DomainService - c:\documents and settings\luke\application data\tmpf4.tmp.exe /service


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Broadcom 4211 iLine10(tm) Network Adapter
Device ID: PCI\VEN_14E4&DEV_4211&SUBSYS_000213E0&REV_00\3&61AAA01&0&68
Manufacturer: Broadcom
Name: Broadcom 4211 iLine10(tm) Network Adapter
PNP Device ID: PCI\VEN_14E4&DEV_4211&SUBSYS_000213E0&REV_00\3&61AAA01&0&68
Service: BCM42XX


-- Scheduled Tasks -------------------------------------------------------------

2007-10-23 21:47:43 330 --ah----- C:\WINDOWS\Tasks\MP Scheduled Scan.job
2007-10-22 13:36:02 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job


-- Files created between 2007-09-24 and 2007-10-24 -----------------------------

2007-10-23 23:34:54 0 d-------- C:\ie-spyad_zo
2007-10-23 21:43:38 131 --a------ C:\WINDOWS\system32\pfdnnt_actions.sys
2007-10-23 21:43:37 8704 --a------ C:\WINDOWS\system32\pfdnnt.exe <Not Verified; Panda Software International; Panda Anti-malware>
2007-10-23 20:36:05 0 d-------- C:\Documents and Settings\Luke\Application Data\Registry Cleaner
2007-10-16 19:21:24 0 d-------- C:\Documents and Settings\Luke\Application Data\Move Networks


-- Find3M Report ---------------------------------------------------------------

2007-10-24 00:04:57 1207237 --a------ C:\WINDOWS\system32\dn3cae505a.dat
2007-10-23 22:38:48 0 d-------- C:\Program Files\Windows Defender
2007-10-23 22:16:55 0 d-------- C:\Program Files\LimeWire
2007-10-23 22:12:09 0 d-------- C:\Program Files\iTunes
2007-10-07 02:33:32 86528 --a------ C:\Documents and Settings\Luke\Application Data\tmpC1.tmp.exe
2007-09-19 09:22:52 86528 --a------ C:\Documents and Settings\Luke\Application Data\tmpB5.tmp.exe
2007-09-13 16:35:05 0 d-------- C:\Documents and Settings\Luke\Application Data\Help
2007-09-07 19:26:39 79634 --a------ C:\Documents and Settings\Luke\Application Data\tmpF5.tmp.exe
2007-09-07 19:26:36 55333 -----n--- C:\Documents and Settings\Luke\Application Data\tmpF4.tmp.exe


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89AD4D75-2429-462e-BD4E-443F233F6033}]
10/07/2007 02:33 AM 67072 --a------ C:\WINDOWS\system32\tmpC1.tmp.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{da9bc17f-36cd-4e2e-8f5e-eac6bd678f23}]
06/23/2007 05:04 PM 92554 --------- C:\WINDOWS\system32\CMDl32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [06/29/2007 06:24 AM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [07/10/2007 09:18 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 07:00 AM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\CMDl32]
CMDl32.dll 06/23/2007 05:04 PM 92554 C:\WINDOWS\system32\CMDl32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=c:\windows\system32\fccbxvw.dll




-- End of Deckard's System Scanner: finished at 2007-10-24 0009 ------------
Attached Files
File Type: txt extra.txt (12.6 KB, 0 views)
amt0514 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 10-25-2007, 08:23 PM   #2 (permalink)
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
 
amateur's Avatar
 
Join Date: Jun 2006
Location: Rhode Island, USA
Posts: 3,628
OS: XP Home SP3, XP MCE SP3, XP Pro SP3


Re: Please Help- annoying pop-ups in IE
Hello and welcome to TSF.

I am not seeing any antivirus application running. That's not acceptable at all. Please download one of these (free for personal use) anti-virus programs RIGHT NOW, update it and run a full scan. Have it fix anything it finds.

Grisoft AVG from here : http://free.grisoft.com/doc/1
AntiVir Free from here : http://www.free-av.com/
Avast Home Edition from here : http://www.avast.com/eng/down_home.html

Note: You must only use 1 (one) AV at a time because if you have 2 or more AVs running at the same time, they will conflict with each other and make your security less reliable.

====================================

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Click Start>Run, type in appwiz.cpl and press Enter.
  • Remove all entries of Runtime Environment (J2SE or JRE) that are listed.
  • Now reboot your computer.
  • Download the latest version of Java Runtime Environment, and install it to your computer.
====================================

Please disable Windows Defender Real Time Protection as it may interfere with the fix.

To disable Windows Defender:
  • Open Windows Defender
  • Click Tools
  • Click General Settings
  • Scroll down to Real Time Protection Options
  • Uncheck Use Real Time Protection (recommended)
  • After you uncheck this, click on the Save button
  • Close Windows Defender
Once your log is clean you can re-enable Windows Defender Real Time Protection.

====================================

Scan with HijackThis and put a checkmark against the following entries:

O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\system32\tmpC1.tmp.dll
O2 - BHO: (no name) - {da9bc17f-36cd-4e2e-8f5e-eac6bd678f23} - C:\WINDOWS\system32\CMDl32.dll
O20 - AppInit_DLLs: c:\windows\system32\fccbxvw.dll
O20 - Winlogon Notify: CMDl32 - C:\WINDOWS\system32\CMDl32.dll
O23 - Service: DomainService - Unknown owner - C:\Documents and Settings\Luke\Application Data\tmpF4.tmp.exe

Close all browsers/windows other than HijackThis and click on "fix checked".

====================================

Download Combofix and save it to your desktop.

**Note: It is important that it is saved directly to your desktop**

1. Close any open browsers. Disconnect from the internet.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall
__________________
My services are free. However, you can donate to TSF to help keep it running and prospering.
ASAP

amateur is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 10-27-2007, 07:11 AM   #3 (permalink)
Registered User
 
Join Date: Oct 2007
Posts: 4
OS: xp


Re: Please Help- annoying pop-ups in IE
Logfile of HijackThis v1.99.1
Scan saved at 1:33:51 AM, on 10/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\QuickTime\QTTask.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\devldr32.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Luke\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Link...ww.google.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {da9bc17f-36cd-4e2e-8f5e-eac6bd678f23} - C:\WINDOWS\system32\CMDl32.dll (file missing)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...59/mcfscan.cab
O20 - Winlogon Notify: CMDl32 - CMDl32.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe





ComboFix 07-10-27.4 - Luke 2007-10-27 1:22:51.1 - NTFSx86
Running from: C:\Documents and Settings\Luke\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Luke\Application Data\tmp963.tmp.exe
C:\Documents and Settings\Luke\Application Data\tmp98D.tmp.exe
C:\Documents and Settings\Luke\Application Data\tmp990.tmp.exe
C:\Documents and Settings\Luke\Application Data\tmpC1.tmp.exe
C:\Program Files\outlook
C:\Program Files\winupdates
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\dn3cae505a.dat
C:\WINDOWS\system32\tmpB5.tmp.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService


((((((((((((((((((((((((( Files Created from 2007-09-27 to 2007-10-27 )))))))))))))))))))))))))))))))
.

2007-10-27 01:21 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-27 00:34 <DIR> d-------- C:\Documents and Settings\Luke\Application Data\AVG7
2007-10-27 00:34 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2007-10-27 00:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2007-10-24 00:00 <DIR> d-------- C:\Deckard
2007-10-23 23:34 <DIR> d-------- C:\ie-spyad_zo
2007-10-23 20:36 <DIR> d-------- C:\Documents and Settings\Luke\Application Data\Registry Cleaner
2007-10-16 19:21 <DIR> d-------- C:\Documents and Settings\Luke\Application Data\Move Networks

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-27 05:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-10-27 04:45 --------- d-----w C:\Program Files\Java
2007-10-24 03:38 --------- d-----w C:\Program Files\Windows Defender
2007-10-24 03:16 --------- d-----w C:\Program Files\LimeWire
2007-10-24 03:12 --------- d-----w C:\Program Files\iTunes
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{da9bc17f-36cd-4e2e-8f5e-eac6bd678f23}]
C:\WINDOWS\system32\CMDl32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-10-27 00:33]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\CMDl32]
CMDl32.dll

R2 SBKUPNT;SBKUPNT;\??\C:\WINDOWS\system32\Drivers\SBKUPNT.SYS
R3 SS1020;Siemens SpeedStream PCI 10/100 Win2000 Driver;C:\WINDOWS\system32\DRIVERS\SS1020N5.SYS
S3 BCM42XX;Broadcom iLine10(tm) Network Adapter Driver;C:\WINDOWS\system32\DRIVERS\bcm42xx5.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-10-22 18:36:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
"2007-10-27 05:34:22 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1239 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-27 01:27:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-27 1:29:31 - machine was rebooted
.
--- E O F ---
amt0514 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 10-27-2007, 07:54 AM   #4 (permalink)
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
 
amateur's Avatar
 
Join Date: Jun 2006
Location: Rhode Island, USA
Posts: 3,628
OS: XP Home SP3, XP MCE SP3, XP Pro SP3


Re: Please Help- annoying pop-ups in IE
Hi,

Well done. I am happy to see that you have installed an antivirus. We'll have to install a third party firewall too, but let's finish with the cleaning process first.

I see that you are using LimeWire, which is a p2p file sharing program. I would like to warn you that the nature of P2P filesharing is so that even if one is using a "clean" program, many of the files downloaded from non-documented sources have the potential of being infected. So, regardless of whether one is using a "clean" program, one may still be prone to infection by malware because more than half of all files available for download from peer-to-peer networks have been deliberately infected with some form of malware. I recommend that you remove it from your system via Add/Remove Programs in Control Panel.

==========================

You'll need to disable Windows Defender so that it will not interfere with the fixes.

To disable Windows Defender:
  • Open Windows Defender
  • Click Tools
  • Click General Settings
  • Scroll down to Real Time Protection Options
  • Uncheck Use Real Time Protection (recommended)
  • After you uncheck this, click on the Save button
  • Close Windows Defender
Once your log is clean you can re-enable Windows Defender Real Time Protection.

===========================

Scan with HijackThis and put a checkmark against the following entries:

O2 - BHO: (no name) - {da9bc17f-36cd-4e2e-8f5e-eac6bd678f23} - C:\WINDOWS\system32\CMDl32.dll (file missing)
O20 - Winlogon Notify: CMDl32 - CMDl32.dll (file missing)

Close all browsers/windows other than HijackThis and click on "fix checked".

===============================

Restart your computer

===============================

Perform an online scan using Internet Explorer with Panda ActiveScan
  • Click on located at the bottom of the page.
  • A "pop up" window will appear. Please ensure that your pop up blocker doesn't block it
  • Enter your e-mail address, country, and state & click "Free Online Scan" The download of the 8 MB Panda's ActiveX control will take place
Begin the scan by selecting
  • If it finds any malware, it will offer you a report.
  • Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
  • Click on then click and post back the contents please.

===============================

Please post back a fresh HijackThis log and the Panda online scan results.
__________________
My services are free. However, you can donate to TSF to help keep it running and prospering.
ASAP

amateur is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 10-27-2007, 03:34 PM   #5 (permalink)
Registered User
 
Join Date: Oct 2007
Posts: 4
OS: xp


Re: Please Help- annoying pop-ups in IE
I uninstalled limewire after I procured these logs, so we're on track. The troublesome entries in the registry are gone now (i don't really understand what was different about this scan-could it be that i not only turned off real time monitoring in windows defender, but disabled the program altogether?) BTW, thanks for the extensive help so far, i thought i could handle this, but you make it seem so easy.

Logfile of HijackThis v1.99.1
Scan saved at 2:11:35 PM, on 10/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Documents and Settings\Luke\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Link...ww.google.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...59/mcfscan.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe


Incident Status Location

Potentially unwanted tool:application/regclean32 Not disinfected C:\Documents and Settings\Luke\Application Data\Registry Cleaner
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Luke\Cookies\luke@2o7[1].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Luke\Cookies\luke@ad.yieldmanager[1].txt
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Luke\Cookies\luke@adrevolver[1].txt
Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\Luke\Cookies\luke@ads.addynamix[1].txt
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Luke\Cookies\luke@ads.pointroll[2].txt
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Luke\Cookies\luke@advertising[1].txt
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Luke\Cookies\luke@apmebf[2].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Luke\Cookies\luke@atdmt[2].txt
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Luke\Cookies\luke@azjmp[1].txt
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Luke\Cookies\luke@bluestreak[2].txt
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Luke\Cookies\luke@bs.serving-sys[2].txt
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Luke\Cookies\luke@burstnet[1].txt
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Luke\Cookies\luke@casalemedia[2].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Luke\Cookies\luke@com[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Luke\Cookies\luke@doubleclick[1].txt
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Luke\Cookies\luke@drivecleaner[2].txt
Spyware:Cookie/Enhance Not disinfected C:\Documents and Settings\Luke\Cookies\luke@enhance[2].txt
Spyware:Cookie/ErrorSafe Not disinfected C:\Documents and Settings\Luke\Cookies\luke@errorsafe[1].txt
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Luke\Cookies\luke@fastclick[1].txt
Spyware:Cookie/GoClick Not disinfected C:\Documents and Settings\Luke\Cookies\luke@goclick[2].txt
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Luke\Cookies\luke@media.adrevolver[3].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Luke\Cookies\luke@mediaplex[2].txt
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Luke\Cookies\luke@overture[1].txt
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Luke\Cookies\luke@questionmarket[1].txt
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Luke\Cookies\luke@realmedia[2].txt
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Luke\Cookies\luke@server.iad.liveperson[2].txt
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Luke\Cookies\luke@serving-sys[2].txt
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Luke\Cookies\luke@statcounter[1].txt
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Luke\Cookies\luke@stats.drivecleaner[1].txt
Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\Luke\Cookies\luke@stats1.reliablestats[2].txt
Spyware:Cookie/Systemdoctor Not disinfected C:\Documents and Settings\Luke\Cookies\luke@systemdoctor[2].txt
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Luke\Cookies\luke@trafficmp[1].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Luke\Cookies\luke@tribalfusion[1].txt
Spyware:Cookie/Winantiviru