Browser pop-up problems

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by jdamato, Mar 30, 2005.

  1. jdamato

    jdamato Private E-2

    I have encountered a problem with Internet Explorer. I keep getting annoying pop-up screens with a variety of advertising.

    I have a Yahoo pop-up blocker on my browser. I have also run Adaware SE, Spyware Blaster, Nortons Antivirus software numerous times and deleted any of the files identified.

    Despite all of this the problem still exists.

    Help!!!!

    Jdamato
     
  2. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    First, please follow ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

    After doing ALL of the above if you still have a problem:


    • Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT
    • Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file.
    • Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.
    • Run HijackThis and save your log file.
    • Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post).

     
  3. jdamato

    jdamato Private E-2

    I have taken all of the steps as per you email, but still get annoying pop-ups on Internet Explorer. I am also having severe problems with start up, and am getting the blue screen with error messages.

    I have run Hijack This, here is the log file:

    Edit by chaslang: Inline log removed. Please attach logs when they are requested.
     
    Last edited by a moderator: Apr 2, 2005
  4. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Please read my post VERY closely!

    First:
    Please EXTRACT HijackThis from the ZIP File to a Safer location. Here's how:

    To create a new folder:
    Click START > My Computer > Local Disc C: > Program Files
    Now, RightClick on an Empty Area and select New > Folder & name it HijackThis and ENTER

    To Extract HijackThis:
    Now, Right Click your HijackThis ZIP File and select Extract All > Next > and browse to your newly created HijackThis Folder
    (C:\Program Files\HJT) and click Next.

    Now run HJT from there. Please save your HJT Log as a .txt File and attach it via the "Manage Attachments" tool in the Additional Options section when you post.

    The reason HJT needs its own safe folder is so that backups will be safely preserved. That way, if a mistake is made in the removal process, the mistakenly deleted entry can be restored.

    • C:\WINDOWS\DESKTOP\JOES JUNK\HELPER APPS\HIJACKTHIS\HIJACKTHIS.EXE

    Second:
    Please close ALL browsers while running Hijack This!
    • C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    • C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

    After doing these steps post a new HJT log as an ATTACHMENT to your post.
     
  5. jdamato

    jdamato Private E-2

    Here is the Hijackthis log file as you have requested.
     

    Attached Files:

    • log.txt
      File size:
      11.2 KB
      Views:
      2
  6. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    You did not close all browsers as I requested, before you fix anything with HJT, CLOSE THESE BROWSERS!!!

    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE


    Now scan with HijackThis and Check the Boxes for the following:

    Make sure All Browser Windows are Closed when you Click FIX.

    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://minisearch.startnow.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://minisearch.startnow.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

    O4 - HKLM\..\Run: [program load sect mapi] C:\WINDOWS\All Users\Application Data\Time boob program load\dead knob.exe
    O4 - HKLM\..\Run: [MSConfigReminder] C:\WINDOWS\SYSTEM\msconfig.exe /reminder
    O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
    O4 - HKCU\..\Run: [LoadPart] C:\WINDOWS\APPLIC~1\BATDRV~1\Dog loud.exe
    O4 - HKCU\..\RunServices: [LoadPart] C:\WINDOWS\APPLIC~1\BATDRV~1\Dog loud.exe

    O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
    O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/platypus/miniclipGameLoader.dll
    O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cab
    O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.bc.edu/bc_org/avp/law/lwsch/journals/wfplayer/tdserver.cab
    O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) -http://qp.wnyric.org/qp2.cab
    O16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} (SekureL0gin.SekureKontrol) - http://secure2.comned.com/signuptemplates/AktiveSekurity.cab

    Again, make sure All Browser Windows are Closed when you Click FIX.

    NOW:
    Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

    C:\WINDOWS\about.htm

    C:\WINDOWS\All Users\Application Data\Time boob program load ←–– Delete this whole folder if it exist!

    C:\WINDOWS\Application Data\BATDRV~1 ←–– Delete this whole folder if it exist!

    NEXT:
    Run CCleaner and Spybot S&D and have Spybot fix what it finds.
    Note: Dont forget to update Spybot S&D by selecting "Search For Updates"

    Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
    Temporary Files
    Temporary Internet Files
    Recycle Bin


    And Click OK.

    Reboot to Normal Windows

    FINAL STEP

    Reset Web Settings & Default Security Settings:


    To Reset Web Settings:
    Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

    If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


    To Default Security Settings:
    Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.



    Scan with HijackThis and attach the new log.
    Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

    Good Luck!:)
     
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    This should not be fixed! It is a required process from Microsoft! If deleted you will probably end up with BSOD!

    Some people say it is not needed on Win9x. I'm not sure right now but know it causes problems when removed.
     
  8. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    I was told in PM to remove it from startup, leave the file as is and get updates from Microsoft.

    I guess I will leave it as is from now on.
     
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I have mixed feelings about this right now. We need to do some research on this! No time right now but this may be a good place to start: http://www.microsoft.com/technet/security/bulletin/MS05-002.mspx
     
  10. jdamato

    jdamato Private E-2

    Re: Browser pop-up problems---completed tasks

    I have completed all of the tasks as outlined in your response. So far I do not have thepop ups, so all may be well.

    I have attached the latest Hijackthis log file.

    Thanks
     

    Attached Files:

  11. bjgarrick

    bjgarrick MajorGeeks Admin - Malware Expert

    Your log is clean!

    Are you currently having any further problems?
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds