Unwanted popup ads (even when not browsing WWW) and browser hijacking

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by kevinmd88, Jun 18, 2005.

  1. kevinmd88

    kevinmd88 Private E-2

    Hi there everyone.

    I have a very strange case of popup ads that I've been trying to fix for days now. It seems that I have these two files, rdsndin.exe and cisvvc.exe, that appear to be causing all of these offensive popup ads. (Actually, I'm not even exactly sure that these are causing the problem; I just know that they don't show up in the *Windows* task manager [XP] - they do show up in a third party task manager I downloaded, though; and that whenever I terminate their processes, the popups cease.) They consist mainly of gambling and pornographic content. Other than that, here is everything I know about the problem:

    - The two files that I mentioned above are nowhere to be found on my hard drive;
    - Whenever I terminate their processes, they restart themselves a seemingly random amount of time afterward;
    - [I think] the browser hijacking (or whatever it's called where you type in one URL and for some reason it takes you to another) still continues to occur even when these processes are terminated and not running;
    - I have done several spyware scans since these popups started coming up, with "Ad-Aware" by Lavasoft and deleted everything it came up with;
    - I have done a few virus scans also, with Norton Anti-Virus 2005, and fixed everything it found;
    - I had a toolbar called "SearchToolbar" on my computer at one point but I disabled that (it was listed under "Manage Add-Ons" in Internet Explorer) - I can't find the files for that toolbar either.
    - I have run Spybot Search & Destroy once and deleted everything it found.

    Other than that, this is baffling the heck out of me, especially since in so many cases the files that are supposedly running on my computer are not in the folders that my "Iarsn TaskInfo 6.x" task manager/viewer tells me they are. Oh, and for the record, it says they're running out of my WINDOWS\system32 file.

    Can anybody help me? Thanks in advance...

    ~Kevin
     
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Well the files must be on your computer of the processes would not be running. You may not have viewing of hidden and system files enabled (for Windows Explorer) also for Windows Search, special options are required to find hidden and system files.

    Please follow the steps below:

    - Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

    Make sure you check version numbers and get all updates.

    - Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


    After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps below:

    - Download HijackThis 1.99.1

    - Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

    - Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

    - Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

    - Run HijackThis and save your log file.

    - Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds