MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Malware Removal
Register FAQ Members List Calendar Casino Mark Forums Read

Malware Removal Malware removal forum. Please see the READ ME FIRST thread before you post. Forum is staffed by a small number of volunteers, please be patient.


Reply
 
Thread Tools Display Modes
  #1  
Old 12-08-07, 15:53
mfletcher35 mfletcher35 is offline
Private First Class
 
Join Date: Jan 2005
Posts: 30
Thanks: 0
Thanked 0 Times in 0 Posts
Default One Pop Up I Just Can't Get Rid Of (Netflix)

First, I already read the "Read And Run Me First" thread. I went through Add/Delete Programs, Downloaded CCleaner and ran it.

I still have this one pop up from "Netflix" that pops up every minute or two. If my computer is turned on and I am logged in, it will pop up. I don't even need to have any other browser windows open and it will pop up. I have a Compaq Preserio Laptop, I am running Winndows XP SP2, and I have Norton Internet Security 2007.

The pop up seems to be a GIF add for Netflix. The GIF is 720 x 300 pixels. In the blue bar at the top of the pop up it says "Advertisement." If I right click on the pop up and click on properties, it says address nztv.untd.com/webads/24381/1007_007_A_720300_A.gif

Is anyone familiar with this pop up and have any suggestions how I can delete it once and for all? Thanks, Mark.

Last edited by bjgarrick; 12-08-07 at 16:11.. Reason: Made link unclickable!
Reply With Quote
Sponsored links
  #2  
Old 12-08-07, 16:11
bjgarrick's Avatar
bjgarrick bjgarrick is offline
MajorGeeks Admin - Malware Expert
 
Join Date: Oct 2004
Location: Southern Alabama
Posts: 16,069
Thanks: 0
Thanked 224 Times in 221 Posts
Default Re: One Pop Up I Just Can't Get Rid Of (Netflix)

Welcome to MajorGeeks.com!

Please follow the instructions in the below link and attach the requested logs when you finish these instructions.

Read & RUN ME FIRST Before Asking for Support
Reply With Quote
  #3  
Old 12-08-07, 16:37
mfletcher35 mfletcher35 is offline
Private First Class
 
Join Date: Jan 2005
Posts: 30
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: One Pop Up I Just Can't Get Rid Of (Netflix)

Okay, maybe I'm just not seeing it in the instructions. What Files do you want me to attach? I see the part about showing hidden files, but I don't see anything as to what files to attach. Sorry.
Reply With Quote
  #4  
Old 12-09-07, 06:41
mfletcher35 mfletcher35 is offline
Private First Class
 
Join Date: Jan 2005
Posts: 30
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: One Pop Up I Just Can't Get Rid Of (Netflix)

I guess you're talking about the MGTools files? Please correct me if I'm wrong. I am attaching the runkeys.txt log. I can not attach GetUnKey.txt because the file size (263 KB) exceeds the forum limit. Thanks, Mark.
Attached Files
File Type: txt runkeys.txt (32.2 KB, 1 views)
Reply With Quote
  #5  
Old 12-09-07, 08:11
abri's Avatar
abri abri is offline
Major Geek
 
Join Date: May 2005
Location: inside the Trojan Horse
Posts: 6,000
Thanks: 24
Thanked 47 Times in 46 Posts
Default Re: One Pop Up I Just Can't Get Rid Of (Netflix)

Hi mfletcher35

In the link bjgarrick posted for you in post number 2, there are a set of instructions below the part which tells you how to show hidden files. Please go to the bottom of the page of the READ & RUN ME link and click on the instructions for your operating system, which would be XP. Follow the instructions on that page and post the set of logs which will be produced by running a file called MGTools.exe. The logs are all in a single zipped file called MGlogs.zip. The procedure is not lengthy and it will give bjgarrick the information he needs to help you further.
Reply With Quote
Sponsored links
  #6  
Old 12-09-07, 08:30
bjgarrick's Avatar
bjgarrick bjgarrick is offline
MajorGeeks Admin - Malware Expert
 
Join Date: Oct 2004
Location: Southern Alabama
Posts: 16,069
Thanks: 0
Thanked 224 Times in 221 Posts
Default Re: One Pop Up I Just Can't Get Rid Of (Netflix)

Quote:
Originally Posted by mfletcher35 View Post
Okay, maybe I'm just not seeing it in the instructions. What Files do you want me to attach? I see the part about showing hidden files, but I don't see anything as to what files to attach. Sorry.
As abri stated, Read closer and you will see exactly what I am requesting.
Reply With Quote
  #7  
Old 12-10-07, 07:42
mfletcher35 mfletcher35 is offline
Private First Class
 
Join Date: Jan 2005
Posts: 30
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: One Pop Up I Just Can't Get Rid Of (Netflix)

Okay. Thank you. I'm attaching MGlogs.zip. I hope this is what you are looking for.

Mark
Attached Files
File Type: zip MGlogs.zip (54.3 KB, 1 views)
Reply With Quote
  #8  
Old 12-10-07, 10:42
bjgarrick's Avatar
bjgarrick bjgarrick is offline
MajorGeeks Admin - Malware Expert
 
Join Date: Oct 2004
Location: Southern Alabama
Posts: 16,069
Thanks: 0
Thanked 224 Times in 221 Posts
Default Re: One Pop Up I Just Can't Get Rid Of (Netflix)

First, please disable any antivirus and/or antispy programs you have installed so they will not block this fix.

Step 1:
Please look in Add/Remove Programs for the following and uninstall if found. If you get any errors just make a note and proceed.

Quote:
AVG Anti-Spyware
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java(TM) 6 Update 2
Java(TM) SE Runtime Environment 6 Update 1
Spybot - Search & Destroy
Step 2:
Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

Quote:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://my.netzero.net/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.net/s/search?r=minisearch

O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
Again, make sure ALL browser windows are closed when you click FIX.

Step 3:
Now download The Avenger by Swandog46, and save it to your Desktop.
  • Extract avenger.exe from the Zip file and save it to your desktop
  • Run avenger.exe by double-clicking on it.
  • Check the 'Input script manually' box.
  • Click on the magnifying glass icon.
  • Copy everything in the Quote box below, and paste it in the box that opens:
Quote:
Files to delete:
C:\WINDOWS\checkip.dat
C:\WINDOWS\temp\sqlite~2
  • Now click the 'Done' button.
  • Click on the traffic light icon and OK the prompt.
  • You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
  • A log file from Avenger will be produced at C:\avenger.txt

Step 4: Begin here after rebooting from Step 3!
Next Reset Web Settings & Default Security Settings

Note for IE 6 users:
To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites. For IE 7 users, simply click the "Reset all zones to default level" button.

Note for IE 7 users:
Select Internet Options, then the Advanced Tab and then the Reset button under Reset Internet Explorer Settings.


Step 5:
Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.
If you use Firefox browser
  • Click Firefox at the top and choose: Select All
  • Click the Empty Selected button.
    • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser
  • Click Opera at the top and choose: Select All
  • Click the Empty Selected button.
    • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main ATF Cleaner menu to close the program.


Step 6:
Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.
Reply With Quote
  #9  
Old 12-12-07, 20:49
mfletcher35 mfletcher35 is offline
Private First Class
 
Join Date: Jan 2005
Posts: 30
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: One Pop Up I Just Can't Get Rid Of (Netflix)

Sorry it took a few days to get back. I've been traveling on the road and it hasn't been too easy getting an internet connection.

I'm still noticing the netflix ad popping up occasionally. I am also noticing another one from jobs.com.

I am attaching the two logs requested.

Thanks,
Mark
Attached Files
File Type: zip MGlogs.zip (51.7 KB, 2 views)
File Type: txt avenger.txt (1.2 KB, 2 views)
Reply With Quote
  #10  
Old 12-12-07, 21:50
bjgarrick's Avatar
bjgarrick bjgarrick is offline
MajorGeeks Admin - Malware Expert
 
Join Date: Oct 2004
Location: Southern Alabama
Posts: 16,069
Thanks: 0
Thanked 224 Times in 221 Posts
Default Re: One Pop Up I Just Can't Get Rid Of (Netflix)

See the threads below and attach a log from each.

Running Rootkit Revealer

Running GMER to detect rootkits
Reply With Quote
Sponsored links
  #11  
Old 12-13-07, 13:42
mfletcher35 mfletcher35 is offline
Private First Class
 
Join Date: Jan 2005
Posts: 30
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: One Pop Up I Just Can't Get Rid Of (Netflix)

Thank you very much for your continued help and support. I am attaching the two log files.

Mark
Attached Files
File Type: txt RootkitReveal.txt (991 Bytes, 3 views)
File Type: txt GMER.txt (45.2 KB, 3 views)
Reply With Quote
  #12  
Old 12-13-07, 18:24
mfletcher35 mfletcher35 is offline
Private First Class
 
Join Date: Jan 2005
Posts: 30
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: One Pop Up I Just Can't Get Rid Of (Netflix)

Well, I did a little fooling around on my own since posting those two logs. I noticed when I right clicked on a pop-up and clicked on properties it says address nztv.untd.com/webads... Could nztv be short for NetzeroTV? I have Netzero installed on my computer but I never use it. I use the LAN connection or wireless internet. I went to Add/Delete and deleted Netzero. That was several hours ago and I have not had a pop up since. Maybe that was the culprit. I'm keeping my fingers crossed. If anyone else has any other comments or suggestions, my eyes and ears are still open.

Thanks,
Mark
Reply With Quote
  #13  
Old 12-14-07, 09:39
bjgarrick's Avatar
bjgarrick bjgarrick is offline
MajorGeeks Admin - Malware Expert
 
Join Date: Oct 2004
Location: Southern Alabama
Posts: 16,069
Thanks: 0
Thanked 224 Times in 221 Posts
Default Re: One Pop Up I Just Can't Get Rid Of (Netflix)

All of your logs look ok so I would say it was something installed such as the program you mentioned.

If you are not having any other malware problems, it is time to do our final steps:
  1. If we used Pocket Killbox during your cleanup, do the below
    • Run Pocket Killbox and select File, Cleanup, Delete All Backups
  2. If we used ComboFix, you can delete the ComboFix.exe file, C:\ComboFix folder, C:\QooBox folder, C:\WINDOWS\nircmd.exe, C:\combofix.txt and C:\ComboFix-quarantined-files.txt logs that was created.
  3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
  4. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
  5. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
  6. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
  7. If we had you run Avenger, you can delete all files related to Avenger now.
  8. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
  9. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete C:\MGlogs.zip
  10. If you are running Windows XP or Windows ME, do the below:
    • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
    • Then reboot and Enable System Restore to create a new clean Restore Point.
  11. After doing the above, you should work thru the below link:
Reply With Quote
  #14  
Old 12-14-07, 21:21
mfletcher35 mfletcher35 is offline
Private First Class
 
Join Date: Jan 2005
Posts: 30
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: One Pop Up I Just Can't Get Rid Of (Netflix)

I haven't had the problem for over 24 hours now. I hope it is solved. Thanks for the "Final Steps" which I will complete now. Thank you so much for all of your help.

Mark
Reply With Quote
  #15  
Old 12-15-07, 10:50
bjgarrick's Avatar
bjgarrick bjgarrick is offline
MajorGeeks Admin - Malware Expert
 
Join Date: Oct 2004
Location: Southern Alabama
Posts: 16,069
Thanks: 0
Thanked 224 Times in 221 Posts
Default Re: One Pop Up I Just Can't Get Rid Of (Netflix)

Your Welcome!

Surf Safely!
Reply With Quote
Sponsored links
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
BlockBuster or NetFlix? thisisu The Lounge 2 09-03-06 10:36
Cannot open netflix - have removed spyware/ran fix lsp Confused1 Malware Removal 1 08-28-05 12:39


All times are GMT -5. The time now is 01:47.

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds


Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger