[help] damn popup/adware/ i cannot get rid of

help! after resetting my whole system . i made myself at home in my really ugly windows xp interface, changing it to look like mac os, and i found out that everytime i went online with broadband connection, 6 popups will automaticly come out of nowhere. all going to gay/porn sites. i didn't do anything that does this, but it just pops out without me knowing it. i used my adaware se, spybot search..., and antivirus program, but it cannot detect this. what do i do?

#220869

What browser are you using ? If its IE then just get opera or firefox depending

on your personal preference. I like opera more but anything is better than IE.

IE has many stoopid security flaws and makes it verry easy for sites to make it

download spyware and adware on your PC :S

#220871

sorry. forgot to clarify tat the popup runs in firefox.exe. that's the browser i use.

so, i click on netvigator dialup (how i get online), it runs, then i'm online. then 6 annoying popups come out of nowwhere. i use these techniques already

search for some popup-related keywords like gay,

adaware se

spybot

antivirus program

searched throught the startup programs in msconfig for something suspicious

#220872

run hijackthis and see what it finds.

#220880

Well I guess that blows ifido's theory out of the water.

Download a free copy of Ad Aware and run it... let it do a deep registry scan.

That's usualy where 99% of spyware run statements get embedded.

ALL browsers are vulnerable in one way or another. Some just more than others.

#220882

Are you sure you have a firewall running?

#220907

@rjohnstone: he said he already used ad-aware se.

if you have no valuables on your computer, reformat your drive and freshly install windows xp

#220915

Helps if I "read" everything. Sounds like a real nasty one.

I've only come across a few of these P.O.S. that I couldn't get rid of.

I did have to rebuild once or twice and I do have both a physical and software firewall running. I know one of these little buggers got on my system from a VS downloaded from themexp. They are now on my black list.

#220916

darnit. i tried hijack this but i don't know how to use properly. also, are there really no other methods other than resetting my computer?

#221134

Get rid of Firefox and use Opera

#221149

Just ask, if there maybe Webdailer folder in your Program Files?

#221201

darnit. i tried hijack this but i don't know how to use properly. also, are there really no other methods other than resetting my computer?

1. Make sure HijackThis is in its own folder, not in the Temp and not run from within WinZip.

2. Make sure you have the latest version -> HijackThis Page

3. Follow the Quick Start instructions on the above page as well. Do not fix anything yet.

4. Post your log here.

#221229

I have seen this before.. Try Easy Cleaner , You must be a Member.. sign-up but I found it somewhere ells when I download it, don't remember where.

And of course use Firefox or Opera.. But you don't get ridd of the problem, you just move it aside. Next time you have to use Internet Explorer... get it again... so I say get ridd of the problem first, so you have your system clean from it. Then install firefox/opera. It's not good to just leave it there.

Good hunting!

#221347

Logfile of HijackThis v1.97.7

Scan saved at 11:09:39 PM, on 10/16/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:WINDOWSSystem32smss.exe

C:WINDOWSsystem32winlogon.exe

C:WINDOWSsystem32services.exe

C:WINDOWSsystem32lsass.exe

C:WINDOWSsystem32svchost.exe

C:WINDOWSSystem32svchost.exe

C:Program FilesStardockObject DesktopWindowBlindswbload.exe

C:WINDOWSsystem32spoolsv.exe

C:WINDOWSExplorer.EXE

C:Program FilesCommon FilesstardockTrayServer.exe

C:WINDOWSSystem32mediaplayer32.exe

C:WINDOWSSystem32CTHELPER.EXE

C:Program FilesCommon FilesRealUpdate_OBrealsched.exe

C:Program FilesQuickTimeqttask.exe

C:Program FilesTrend MicroPC-cillin 2002pccguide.exe

C:Program FilesTrend MicroPC-cillin 2002PCCClient.exe

C:WINDOWSSystem32RUNDLL32.EXE

C:WINDOWShtpatch.exe

C:Program FilesWinPLOSIONWinPlosion.exe

C:WINDOWSSystem32ctfmon.exe

C:Program FilesStrokeitstrokeit.exe

C:Program FilesKazaa Lite K++KazaaLite.kpp

C:Program FilesMSN MessengerMsnMsgr.Exe

C:Program FilesObject DesktopObjectBarObjectBar.exe

C:Program FilesStardockObjectDockObjectDock.exe

C:Program FilesBitTorrentbtdownloadgui.exe

C:Program FilesExecutive SoftwareDiskeeperDkService.exe

C:Program FilesCommon FilesMicrosoft SharedVS7Debugmdm.exe

C:WINDOWSSystem32nvsvc32.exe

C:Program FilesTrend MicroPC-cillin 2002Tmntsrv.exe

C:Program FilesTrend MicroPC-cillin 2002PCCPFW.exe

C:Program FilesiPodbiniPodService.exe

C:WINDOWSSystem32msiexec.exe

C:WINDOWSSystem32wuauclt.exe

C:Program FilesBillP StudiosWinPatrolWinPatrol.exe

C:WINDOWSsystem32ntvdm.exe

C:Documents and SettingssteelfistDesktopHijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx

O4 - HKLM..Run: [1A:Stardock TrayMonitor] "C:Program FilesCommon FilesstardockTrayServer.exe"

O4 - HKLM..Run: [start Upping] mediaplayer32.exe

O4 - HKLM..Run: [WINDVDPatch] CTHELPER.EXE

O4 - HKLM..Run: [updReg] C:WINDOWSUpdReg.EXE

O4 - HKLM..Run: [TkBellExe] "C:Program FilesCommon FilesRealUpdate_OBrealsched.exe" -osboot

O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime

O4 - HKLM..Run: [Pop3trap.exe] "C:Program FilesTrend MicroPC-cillin 2002Pop3trap.exe"

O4 - HKLM..Run: [pccguide.exe] "C:Program FilesTrend MicroPC-cillin 2002pccguide.exe"

O4 - HKLM..Run: [PCCClient.exe] "C:Program FilesTrend MicroPC-cillin 2002PCCClient.exe"

O4 - HKLM..Run: [nwiz] nwiz.exe /install

O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSSystem32NvMcTray.dll,NvTaskbarInit

O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup

O4 - HKLM..Run: [KernelFaultCheck] %systemroot%system32dumprep 0 -k

O4 - HKLM..Run: [KAZAA] "C:Program FilesKazaa Lite K++kpp.exe" "C:Program FilesKazaa Lite K++KazaaLite.kpp" /SYSTRAY

O4 - HKLM..Run: [Jet Detection] "C:Program FilesCreativeSBLivePROGRAMADGJDet.exe"

O4 - HKLM..Run: [iTunesHelper] C:Program FilesiTunesiTunesHelper.exe

O4 - HKLM..Run: [HTpatch] C:WINDOWShtpatch.exe

O4 - HKLM..Run: [WinPLOSION] "C:Program FilesWinPLOSIONWinPlosion.exe"

O4 - HKLM..Run: [WinPatrol] C:Program FilesBillP StudiosWinPatrolwinpatrol.exe

O4 - HKLM..RunServices: [start Upping] mediaplayer32.exe

O4 - HKCU..Run: [start Upping] mediaplayer32.exe

O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSSystem32ctfmon.exe

O4 - HKCU..Run: [strokeIt] C:Program FilesStrokeitstrokeit.exe

O4 - HKCU..Run: [MsnMsgr] "C:Program FilesMSN MessengerMsnMsgr.Exe" /background

O4 - Startup: NETVIGATOR BROADBAND.lnk = C:Program FilesNETVIGATORNETVIGATOR BROADBANDDial.exe

O4 - Startup: Stardock ObjectBar.lnk = C:Program FilesObject DesktopObjectBarObjectBar.exe

O4 - Startup: Stardock ObjectDock.lnk = C:Program FilesStardockObjectDockObjectDock.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe

O4 - Global Startup: Microsoft Office.lnk = C:Program FilesMicrosoft OfficeOffice10OSA.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:PROGRA~1MICROS~2Office10EXCEL.EXE/3000

O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

O17 - HKLMSystemCCSServicesTcpip..{36BCB4F4-7882-41BC-AE6D-C660373AF006}: NameServer = 205.252.144.126 218.102.62.71

that's from the log. apparently, the delay was caused from the comctl32.dll file from flyakite that prevented me from saving it. oh well.

#221398

I don't recognize any obvious problems.

There is a newer version of HijackThis available.

Certain items are unnecessarily running at startup:

cthelper.exe - if you don't use WinDVD, this is not needed

qttask.exe,realsched.exe are not needed

disabling the Nvidia Driver Helper service will improve your shutdown time

Unless you have a Creative portable media device ADGJDet.exe is not needed

You can safely remove OSA.exe from your startup folder

Some items I'm unsure of:

mediaplayer32.exe

htpatch.exe

strokeit.exe

Also, it appears as if you were installing something using Windows Installer(msiexec.exe)

#222270