1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Adware Help Please

Discussion in 'Virus & Other Malware Removal' started by snookemx, Feb 7, 2007.

Thread Status:
Not open for further replies.
Advertisement
  1. snookemx

    snookemx Thread Starter

    Joined:
    Oct 16, 2006
    Messages:
    90
    My computer every other 1-2 minutes comes up with adware... Could i get some help removing it please?!?!? Ill post my hijackthis log in a couple minutes.. Thanks in advance.

    Hijackthis:


    Logfile of HijackThis v1.99.1
    Scan saved at 8:34:50 AM, on 2/7/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\WebcamMax\CAMTHINS.exe
    C:\Program Files\LClock\LClock.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\LogMeIn\LogMeInSystray.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\MySpace\IM\MySpaceIM.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\D-Link AirPlus\AirPlus.exe
    C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    c:\progra~1\intern~1\iexplore.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Macromedia\Dreamweaver 8\Dreamweaver.exe
    C:\Documents and Settings\Stout\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.itsnewtoyou.biz/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
    O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [WebcamMaxMoniter] "C:\Program Files\WebcamMax\CAMTHINS.exe" /m
    O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\LogMeInSystray.exe"
    O4 - HKLM\..\Run: [CastFirstEncManager] C:\Documents and Settings\All Users\Application Data\copybonecastfirst\plan logo.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
    O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
    O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.6962\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [Vidalia] "C:\Documents and Settings\Stout\Desktop\site\CD\Vidalia\vidalia.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SOFT WARN] C:\DOCUME~1\Stout\APPLIC~1\METAGL~1\Delete Copy Name.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: D-Link AirPlus.lnk = ?
    O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.3.102.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by124w.bay124.mail.live.com/mail/resources/MsnPUpld.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1154457591720
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1161981774840
    O16 - DPF: {A662DA7E-CCB7-4743-B71A-D817F6D575DF} - http://download.autodesk.com/esd/dwfviewer/installer/DwfViewerSetup.cab
    O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://www.driveragent.com/files/driveragent.cab
    O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by105fd.bay105.hotmail.msn.com/activex/HMAtchmt.ocx
    O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
    O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
    O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
     
  2. snookemx

    snookemx Thread Starter

    Joined:
    Oct 16, 2006
    Messages:
    90
    Okay now its comming up on every page i go to. PLEASE HELP. I have no idea what to do. :confused:
     
  3. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    No need to bump
    ==============
    Please Download NoLop to your desktop from

    http://www.thespykiller.co.uk/forum/index.php?action=tpmod;dl=item16

    First close any other programs you have running as this will require a reboot
    · Double click NoLop.exe to run it
    · Now click the button labelled "Search and Destroy"
    <<your computer will now be scanned for infected files>>
    · When scanning is finished you will be prompted to reboot only if infected, Click OK
    · Now click the "REBOOT" Button.
    · A Message should popup from NoLop. If not, double click the program again and it will finish Please Post the contents of C:\NoLop.log along with a fresh HijackThis log
    --If you receive an error, "mscomctl.ocx or one of its dependencies are not correctly registered," please download mscomctl.ocx to your system32 folder then rerun the program. -

    ================
    You may want to print this or save it to notepad as we will go to safe mode.

    Fix these with HiJackThis – mark them, close IE, click fix checked

    O4 - HKLM\..\Run: [CastFirstEncManager] C:\Documents and Settings\All Users\Application Data\copybonecastfirst\plan logo.exe

    O4 - HKCU\..\Run: [SOFT WARN] C:\DOCUME~1\Stout\APPLIC~1\METAGL~1\Delete Copy Name.exe
    DownLoad http://www.downloads.subratam.org/KillBox.zip or
    http://www.thespykiller.co.uk/files/killbox.exe

    Restart your computer into safe mode now. (Tapping F8 at the first black screen) Perform the following steps in safe mode:

    Double-click on Killbox.exe to run it. Now put a tick by Standard File Kill. In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time then click on the button that has the red circle with the X in the middle after you enter each file. It will ask for confimation to delete the file. Click Yes. Continue with that same procedure until you have copied and pasted all of these in the "Paste Full Path of File to Delete" box.

    C:\Documents and Settings\All Users\Application Data\copybonecastfirst
    C:\DOCUME~1\Stout\APPLIC~1\METAGL~1

    Note: It is possible that Killbox will tell you that one or more files do not exist. If that happens, just continue on with all the files. Be sure you don't miss any.

    START – RUN – type in %temp% - OK - Edit – Select all – File – Delete

    Delete everything in the C:\Windows\Temp folder or C:\WINNT\temp

    Not all temp files will delete and that is normal
    Empty the recycle bin
    Boot

    Download Superantispyware

    http://www.superantispyware.com/superantispywarefreevspro.html

    Install it and double-click the icon on your desktop to run it.
    · It will ask if you want to update the program definitions, click Yes.
    · Under Configuration and Preferences, click the Preferences button.
    · Click the Scanning Control tab.
    · Under Scanner Options make sure the following are checked:
    o Close browsers before scanning
    o Scan for tracking cookies
    o Terminate memory threats before quarantining.
    o Please leave the others unchecked.
    o Click the Close button to leave the control center screen.
    · On the main screen, under Scan for Harmful Software click Scan your computer.
    · On the left check C:\Fixed Drive.
    · On the right, under Complete Scan, choose Perform Complete Scan.
    · Click Next to start the scan. Please be patient while it scans your computer.
    · After the scan is complete a summary box will appear. Click OK.
    · Make sure everything in the white box has a check next to it, then click Next.
    · It will quarantine what it found and if it asks if you want to reboot, click Yes.
    · To retrieve the removal information for me please do the following:
    o After reboot, double-click the SUPERAntispyware icon on your desktop.
    o Click Preferences. Click the Statistics/Logs tab.
    o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    o It will open in your default text editor (such as Notepad/Wordpad).
    o Please highlight everything in the notepad, then right-click and choose copy.
    · Click close and close again to exit the program.
    · Please paste that information here for me with a new HijackThis log.


    Please give feedback on what worked/didn’t work and the current status of your system
     
  4. snookemx

    snookemx Thread Starter

    Joined:
    Oct 16, 2006
    Messages:
    90
    It seems that got it. But i have only gone to like 5 sites so im not sure yet. Ill update you more tommarow.

    Here is the Super antispyware log:

    SUPERAntiSpyware Scan Log
    Generated 02/07/2007 at 07:28 PM

    Application Version : 3.5.1016

    Core Rules Database Version : 3179
    Trace Rules Database Version: 1189

    Scan type : Complete Scan
    Total Scan Time : 01:41:28

    Memory items scanned : 377
    Memory threats detected : 0
    Registry items scanned : 5105
    Registry threats detected : 5
    File items scanned : 52214
    File threats detected : 102

    Adware.Tracking Cookie
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][3].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][3].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][3].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected]power[2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][2].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt
    C:\Documents and Settings\Stout\Cookies\[email protected][1].txt

    Adware.WhenU
    HKCR\WUSN.1
    HKCR\WUSN.1#WUSN_Id

    Trojan.Unknown Origin
    HKLM\SOFTWARE\Microsoft\MSSMGR
    HKLM\SOFTWARE\Microsoft\MSSMGR#MSLIST
    HKLM\SOFTWARE\Microsoft\MSSMGR#PID

    Adware.Lop-Gen
    C:\!KILLBOX\COPYBONECASTFIRST\PLAN LOGO.EXE
    C:\!KILLBOX\METAGL~1\DELETE COPY NAME.EXE
    C:\!KILLBOX\METAGL~1\KEEP DRV LOCKS.EXE
    C:\!KILLBOX\METAGL~1\ODRRUAHF.EXE
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{62CFED7B-152C-426F-ABD3-23FD50489FB3}\RP311\A0066123.EXE
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{62CFED7B-152C-426F-ABD3-23FD50489FB3}\RP311\A0066124.EXE
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{62CFED7B-152C-426F-ABD3-23FD50489FB3}\RP311\A0066125.EXE
    C:\SYSTEM VOLUME INFORMATION\_RESTORE{62CFED7B-152C-426F-ABD3-23FD50489FB3}\RP311\A0066126.EXE

    Adware.ClickSpring
    C:\QOOBOX\PURITY\WINDOWS\SYSTEM32\PPATCH~1\NTVDM.EXE










    Hijack this:

    Logfile of HijackThis v1.99.1
    Scan saved at 7:39:40 PM, on 2/7/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\Program Files\WebcamMax\CAMTHINS.exe
    C:\Program Files\LClock\LClock.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\LogMeIn\LogMeInSystray.exe
    C:\Program Files\MySpace\IM\MySpaceIM.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\D-Link AirPlus\AirPlus.exe
    C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Stout\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.itsnewtoyou.biz/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
    O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [WebcamMaxMoniter] "C:\Program Files\WebcamMax\CAMTHINS.exe" /m
    O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\LogMeInSystray.exe"
    O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
    O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
    O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.6962\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [Vidalia] "C:\Documents and Settings\Stout\Desktop\site\CD\Vidalia\vidalia.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: D-Link AirPlus.lnk = ?
    O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    O4 - Global Startup: NoLop.exe
    O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.3.102.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by124w.bay124.mail.live.com/mail/resources/MsnPUpld.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1154457591720
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1161981774840
    O16 - DPF: {A662DA7E-CCB7-4743-B71A-D817F6D575DF} - http://download.autodesk.com/esd/dwfviewer/installer/DwfViewerSetup.cab
    O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://www.driveragent.com/files/driveragent.cab
    O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by105fd.bay105.hotmail.msn.com/activex/HMAtchmt.ocx
    O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
    O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
     
  5. snookemx

    snookemx Thread Starter

    Joined:
    Oct 16, 2006
    Messages:
    90
    Well right after i posted this, i went to hotmail.com and another came up. there must be another somewhere.
     
  6. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    Describe the pop up
     
  7. snookemx

    snookemx Thread Starter

    Joined:
    Oct 16, 2006
    Messages:
    90
  8. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    That is not very detailed

    Post the contents of C:\NoLop.log

    Download AVG Anti-Spyware from http://www.ewido.net/en/download/ and save that file to your desktop. Note: This is NOT the Anti Virus from AVG.

    When the trial period expires it becomes feature-limited freeware but is still worth keeping as a good on-demand scanner.
    1. Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop and double click it to launch the set up program.
    2. Once the setup is complete you will need run AVG Anti-Spyware and update the definition files.
    3. On the main screen select the icon "Update" then select the "Update now" link.
    o Next select the "Start Update" button. The update will start and a progress bar will show the updates being installed.
    4. Once the update has completed, select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
    5. Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
    6. Under "Reports"
    o Select "Automatically generate report after every scan"
    o Un-Select "Only if threats were found"
    Close AVG Anti-Spyware. Do Not run a scan just yet, we will run it in safe mode.
    1. Reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.

    IMPORTANT: Do not open any other windows or programs while AVG Anti-Spyware is scanning as it may interfere with the scanning process:
    2. Launch AVG Anti-Spyware by double clicking the icon on your desktop.
    3. Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
    4. AVG will now begin the scanning process. Please be patient as this may take a little time.
    Once the scan is complete, do the following:
    5. If you have any infections you will be prompted. Then select "Apply all actions."
    6. Next select the "Reports" icon at the top.
    7. Select the "Save report as" button in the lower lef- hand of the screen and save it to a text file on your system (make sure to remember where you saved that file. This is important).
    8. Close AVG Anti-Spyware and reboot your system back into Normal Mode.
    Post the log from AVG and a new HiJack log
     
  9. snookemx

    snookemx Thread Starter

    Joined:
    Oct 16, 2006
    Messages:
    90

    Im not going to describe a popup that has porn on it. Im not going to say "She had her legs spread licking her p**** juice while getting deep throated by some shemale." Thats just wrong.

    ... you can close this thread if you want, my dad just fixed it. Thanks for the help though. :D :D
     
  10. MFDnNC

    MFDnNC

    Joined:
    Sep 7, 2004
    Messages:
    49,014
    Of course I did not want that - you mind tell what Dad did?
     
  11. snookemx

    snookemx Thread Starter

    Joined:
    Oct 16, 2006
    Messages:
    90
    He ran some programs in safe mode, then setup a whole bunch of "firewalls." And told me to not go to serial sites again.That was it i dont remember the programs but that gives you a rundown of it. ;)
     
  12. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/541994

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice