porn popups? :(

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

IBM

Thread Starter
Joined
Nov 13, 2000
Messages
824
I know... this has been asked too many times. But I have done searches and done research. My problems stem from the fact that even after googling programs I still am not sure if one or the other are trojans, adware etc...

I learned bmeb.dll should go... But as for some of the others I just don't know...
Can someone help me out plz...
Earlier today my brother got gay porn popups... I can't have this happening. I don't even know how this happened, all I know is that one day I started getting 505 error pages, I get at least 30 per day now, and every now and then I get porn popups..!

It's embarrassing to say the least, enfuriating to say a little more.

I've run hijack this, this is the log:
Logfile of HijackThis v1.96.1
Scan saved at 4:08:41 AM, on 9/22/2003
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Agnitum\OUTPOS~1.0\outpost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Documents and Settings\Drake\Desktop\snooper\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page
= http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,ProxyOverride = 127.0.0.1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start
Page_bak = http://www.flipcode.com/articles/article_buildinggame.shtml
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = iexplore
N1 - Netscape 4: user_pref("browser.startup.homepage", "www.yahoo.com"); (C:\Program
Files\Netscape\Users\drake\prefs.js)
O2 - BHO: (no name) - {00000273-8230-4DD4-BE4F-6889D1E74167} - C:\WINDOWS\host.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-
784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\PROGRA~1\FRESHD~1\FRESHD~2\fdiehlp.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1.1\SDHelper.dll
O2 - BHO: ineb Helper - {753AA023-02D1-447D-8B55-53A91A5ABF18} - C:\WINDOWS\System32\bmeb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Search Bar - {0AAF602E-72A1-45FE-BAB1-06971E07EAA2} - C:\WINDOWS\System32\bmeb.dll
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft
Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [AVG_CC] C:\Program Files\Grisoft\AVG6
\avgcc32.exe /startup
O4 - HKLM\..\Run: [Outpost Firewall] C:\PROGRA~1\Agnitum\OUTPOS~1.0\outpost.exe /waitservice
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32
\dumprep 0 -k
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - Startup: WinRescueXP.lnk = C:\Program Files\WinRescueXP\RescueXP.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control
Panel present
O8 - Extra context menu item: &Download with AutoSyncFTP -
C:\Program Files\AutoSyncFTP\asf.htm
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Run AutoSyncFTP (HKLM)
O9 - Extra 'Tools' menuitem: AutoSyncFTP (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://xrosspost.distanthost.com
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F}
(Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CA B?37868.9815856482
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}
(Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swfl ash.cab

I've got SSD ready and on standby...
So aside from bmeb.dll, anything else gotta go?

Thank you.
 

IBM

Thread Starter
Joined
Nov 13, 2000
Messages
824
correction...
I get a 502 error, bad gateway.
I just got one after refreshing..


eep...
 

IBM

Thread Starter
Joined
Nov 13, 2000
Messages
824
um..*sigh*

ignore this 3rd post, It's now been edited to remove the last entry..sorry about that.
 

TonyKlein

Malware Specialist
Joined
Aug 26, 2001
Messages
10,392
This is what needs to be fixed:

O2 - BHO: (no name) - {00000273-8230-4DD4-BE4F-6889D1E74167} - C:\WINDOWS\host.dll
O2 - BHO: ineb Helper - {753AA023-02D1-447D-8B55-53A91A5ABF18} - C:\WINDOWS\System32\bmeb.dll

O3 - Toolbar: Search Bar - {0AAF602E-72A1-45FE-BAB1-06971E07EAA2} - C:\WINDOWS\System32\bmeb.dll

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present


Cheers,
 

IBM

Thread Starter
Joined
Nov 13, 2000
Messages
824
thank you.. :)
But why the restrictions, the last one on the list you made?

What does it do?
 

TonyKlein

Malware Specialist
Joined
Aug 26, 2001
Messages
10,392
It restricts access to Internet Options, which isn't practical.

That is, unless you deliberately set this restriction in order to prevent someone else from changing them.
 

TonyKlein

Malware Specialist
Joined
Aug 26, 2001
Messages
10,392
Originally posted by KeithKman:

...... 2) Read http://tomcoyote.org/SPYBOT/index1.html then download and run SpyBot.
:D
You may not have noticed, but if you take a moment to look at that log, you'll see that IBM already HAS SpyBot installed... :D

In fact, that's how this restriction was set in the first place: IBM actually implemented those himself by checking the "Miscellaneous protection" boxes in SpyBot S&D's "Immunize" section.
 

IBM

Thread Starter
Joined
Nov 13, 2000
Messages
824
:D
Yeah, tis true.. har har .. :D
Thanks, got things rolling now.. so far. Popups used to come up intermitently... good nes is I've yet to see a porn ad :) Thanks!

Umm.. why does this website and forums trigger S&D's residential warning for avenue A inc?
Keeps saying you guys are trying to make me download avena A,inc?
This true... :eek: .. um, couldn't find a funnier smiley, maybe something like :blink: .. so don't take the above smiley wrong.. :)
 
Joined
Aug 18, 2003
Messages
995
if you want to be immunized from avenue a inc., but not have to close that annoying window, just go to the spybot s&d immunize window, then in the dropdown menu under "permanently running bad download helper..." choose "block all pages silently".
 

IBM

Thread Starter
Joined
Nov 13, 2000
Messages
824
Hi thanks for the tip :)
But uh, no, that's not it, I really wanted to know why helponthe.net is causing this alert?

thanks though, I didn't know that, so maybe I'll do it. :)
Thank you.
 

Byteman

Gone but Never Forgotten
Joined
Jan 24, 2002
Messages
17,742
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Top