|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
02-28-2006, 01:06 PM
|
#1 (permalink) | |
|
Registered User
Join Date: Feb 2006
Posts: 13
OS: WINXP Home
|
Zeno, Adware-Look2Me, Qoolaid
Above are just some of the above that have come up. This is my sisters laptop, and although I've done just about everything I can think of before I let her have it, somehow she still managed to get junk on here.
Upon starting up, popups just start comin up, non-stop. Spybot scan and Ad-aware both find things, delete them, then upon restart they're right back. McAfee keeps finding things with its On-Access scan (some of which are listed in title). Here's the HJT log: Quote:
|
|
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
02-28-2006, 04:22 PM
|
#2 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,355
OS: N/A
|
Please do the following:
Download & immediately run - L2MFix.exe Click "Install" to extract the contents to a newly created folder. Close any programs you have open since this step requires a reboot.
On the reboot notepad will open with a log. Copy/paste the contents of that log back into this thread, along with a new hijackthis log. IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so! If after the reboot the log does not open double click on it in the l2mfix folder to locate log.txt. If you receive an error - \system32\Autoexec.nt is not suitable for running MS-Dos applications, you will need to visit this website to download additional files.
__________________
Question - what have you done for the community today? |
|
|
|
|
03-01-2006, 02:34 PM
|
#3 (permalink) | ||
|
Registered User
Join Date: Feb 2006
Posts: 13
OS: WINXP Home
|
k,
Quote:
Quote:
|
||
|
|
|
|
03-01-2006, 03:09 PM
|
#4 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,355
OS: N/A
|
Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.
* * * * * * Go to Start -> Control Panel -> Add or Remove Programs and uninstall the following programs:
If there is no Add/Remove Programs entry for this programs, click on Start, then Run and type the following in the Open: field:
A code will be displayed that it will ask you to enter. Enter this code and reboot. Once back to your desktop continue with the rest of the fix. * * * * * * DISABLING SERVICES * * * * * * * * * * * * * * * * * Click Start -> Run - type SERVICES.MSC & then click on the OK button
* * * * * * FIXING ENTRIES WITH HIJACKTHIS * * * * * * * * * * Do a HijackThis scan & place a check next to these items and select "Fix checked": R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.findthewebsiteyouneed.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll O4 - HKLM\..\Run: [winsysupd] C:\\winsysupd12.exe O4 - HKLM\..\Run: [winsysban] C:\\winsysban12.exe O4 - HKLM\..\Run: [gimmygames] c:\\gimmygames12.exe O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\SYSC00.exe O4 - HKLM\..\Run: [sys09346471615] C:\WINDOWS\sys09346471615.exe O4 - HKLM\..\Run: [pzhmbc] C:\WINDOWS\system32\pzhmbc.exe O4 - HKLM\..\Run: [kwugsc] C:\WINDOWS\system32\kwugsc.exe O4 - HKLM\..\Run: [loadadv64] C:\WINDOWS\system32\loadadv64 O4 - HKLM\..\Run: [guarnset] C:\WINDOWS\system32\guarnset.exe O4 - HKLM\..\Run: [BrowserUpdateSched] C:\WINDOWS\system32\mwinrrai.exe CORN001 O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe O4 - Startup: Zeno.lnk = C:\WINDOWS\system32\mwinrrai.exe O20 - AppInit_DLLs: repairs303169536.dll O20 - Winlogon Notify: App Management - C:\WINDOWS\system32\h60qlgd5160.dll (file missing) * * * * * * Download & SAVE ON DESKTOP, the file attached - fix.zip ** It's important that the file must be saved to Desktop From within it, double-click on fix.exe & allow it to run It shall reboot your computer automatically & present you with a log which you should post back here. Also post a fresh HJT log
__________________
Question - what have you done for the community today? Last edited by sUBs; 03-02-2006 at 11:38 AM. |
|
|
|
|
03-02-2006, 11:16 AM
|
#5 (permalink) | ||
|
Registered User
Join Date: Feb 2006
Posts: 13
OS: WINXP Home
|
Alrighty, here we go...
Quote:
Quote:
|
||
|
|
|
|
03-02-2006, 11:41 AM
|
#6 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,355
OS: N/A
|
Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.
* * * * * * ADDITIONAL DOWNLOADS * * * * * * * * * * * * * * Download & install CleanUp.exe (not recommended for WinXP64) Download and install Ewido Security Suite
* * * * * * RESTART WINDOWS IN SAFE MODE * * * * * * * * * * 1. Restart your computer 2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8. 3. Instead of Windows loading as normal, a menu should appear 4. Select the option to run Windows in Safe Mode. * * * * * * PURGING TEMP FOLDERS * * * * * * * * * * * * * * * Run Cleanup! using the following configuration: 1. Click Options... 2. Set the slider initially to Standard CleanUp! 3. Uncheck the following:
5. Press the CleanUp! button to start the program. 6. Do NOT reboot/logoff if prompted. * CleanUp! will not create any backups!! * * * * * * RUNNING ADDITIONAL SCANNERS * * * * * * * * * * * Run Ewido with it's updated definitions:(...it's important that all windows must be closed)
** Ewido scan would require at least an hour. I suggest that you go grab a cup of coffee & do something else while you wait for it to complete. * * * * * * REBOOT TO NORMAL MODE * * * * * * * * * * * * * * Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
* * * * * * CHECK LIST * * * * * * * * * * * * * * * * * * * * * In your next post, please include fresh logs from:
__________________
Question - what have you done for the community today? |
|
|
|
|
03-03-2006, 11:59 AM
|
#7 (permalink) |
|
Registered User
Join Date: Feb 2006
Posts: 13
OS: WINXP Home
|
The File "C:\avenger\backup.zip/avenger/gimmygames12.exe" cannot be removed because it is embedded in the archive "C:\avenger\backup.zip". Do you want to remove the whole archive?
That is the current message that I have on the screen (I'm on a different computer posting this, btw). Shall I delete the archive or leave it as is?? |
|
|
|
|
03-04-2006, 02:07 PM
|
#9 (permalink) | |||
|
Registered User
Join Date: Feb 2006
Posts: 13
OS: WINXP Home
|
Computer is running much faster now. No more popup ads, and I can type without the cursor just jumping around on me now. However McAfee On-Access scan is still finding things. Here's the three requested logs...
Quote:
Quote:
Quote:
|
|||
|
|
|
|
03-04-2006, 02:21 PM
|
#10 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,355
OS: N/A
|
Please read this post completely before begining the fix.
Right click on this & choose "Save As..." DelO15Domains.inf - DelO15Domains.inf Right click on DelO15Domains.inf and choose Install. It will run immediately (you won't be able to see anything happen). You may delete the file afterwards. SpywareBlaster 3.5.1 - Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items IE-SpyAD - Extract the contents to a new folder From within the folder, double-click install.bat Select Option #2 - Install the new IE-SPYAD list. Then return to the main menu. Select option #4 - Add the old porn sites domain * * * * * * Launch ThunderBird & delete this email from the inbox: Tue, 19 Apr 2005 12:12:34 -0700]/UNNAMED/[From "CareerBuilder.com" <Jobs@alerts.CareerBuilder.com>][Date Wed, 20 Apr 2005 04:59:08 -0400]/UNNAMED/[From "CareerBuilder.com" <Jobs@alerts.CareerBuilder.com>][Date Sat, 30 Apr 2005 01:11:30 -0400]/UN ... /[From ... /[From eBay Inc <support_id_43160986491@ebay.com>][Date Fri, 19 Aug 2005 04:05:42 +0400]/html * * * * * * FIXING ENTRIES WITH HIJACKTHIS * * * * * * * * * * Do a HijackThis scan & place a check next to these items and select "Fix checked": F2 - REG:system.ini: UserInit=userinit.exe * * * * * * RESTART WINDOWS IN SAFE MODE * * * * * * * * * * 1. Restart your computer 2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8. 3. Instead of Windows loading as normal, a menu should appear 4. Select the option to run Windows in Safe Mode. * * * * * * DELETING FILES/FOLDERS * * * * * * * * * * * * * * * If you have not done so already, please enable the viewing of Hidden files From Windows Explorer, go to Tools -> Folder Options -> View tab.
* * * * * * PURGING TEMP FOLDERS * * * * * * * * * * * * * * * Run Cleanup! using the following configuration: 1. Click Options... 2. Set the slider initially to Standard CleanUp! 3. Uncheck the following:
5. Press the CleanUp! button to start the program. Reboot & post another HijackThis log
__________________
Question - what have you done for the community today? |
|
|
|
|
03-04-2006, 02:54 PM
|
#11 (permalink) | |
|
Registered User
Join Date: Feb 2006
Posts: 13
OS: WINXP Home
|
I was able to find all files and folders to delete. McAfee also isn't showing any more items in the On-Access scan like it did last time I booted up.
Thank you sooooo very much for all of your help with this matter, btw. Here is the latest HJT log: Quote:
|
|
|
|
|
|
03-04-2006, 03:48 PM
|
#12 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,355
OS: N/A
|
Your system is clean. Kindly follow these simple steps in order to keep your computer clean and secure:
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day.  Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Question - what have you done for the community today? |
|
|
|
| Thread Tools | |
|
|
17 PM, on 3/4/2006
