One Pop Up I Just Can't Get Rid Of (Netflix)

[mfletcher35]

First, I already read the "Read And Run Me First" thread. I went through Add/Delete Programs, Downloaded CCleaner and ran it.

I still have this one pop up from "Netflix" that pops up every minute or two. If my computer is turned on and I am logged in, it will pop up. I don't even need to have any other browser windows open and it will pop up. I have a Compaq Preserio Laptop, I am running Winndows XP SP2, and I have Norton Internet Security 2007.

The pop up seems to be a GIF add for Netflix. The GIF is 720 x 300 pixels. In the blue bar at the top of the pop up it says "Advertisement." If I right click on the pop up and click on properties, it says address nztv.untd.com/webads/24381/1007_007_A_720300_A.gif

Is anyone familiar with this pop up and have any suggestions how I can delete it once and for all? Thanks, Mark.

[bjgarrick]

Welcome to MajorGeeks.com!

Please follow the instructions in the below link and attach the requested logs when you finish these instructions.

Read & RUN ME FIRST Before Asking for Support

[mfletcher35]

Okay, maybe I'm just not seeing it in the instructions. What Files do you want me to attach? I see the part about showing hidden files, but I don't see anything as to what files to attach. Sorry.

[mfletcher35]

I guess you're talking about the MGTools files? Please correct me if I'm wrong. I am attaching the runkeys.txt log. I can not attach GetUnKey.txt because the file size (263 KB) exceeds the forum limit. Thanks, Mark.

[abri]

Hi mfletcher35

In the link bjgarrick posted for you in post number 2, there are a set of instructions below the part which tells you how to show hidden files. Please go to the bottom of the page of the READ & RUN ME link and click on the instructions for your operating system, which would be XP. Follow the instructions on that page and post the set of logs which will be produced by running a file called MGTools.exe. The logs are all in a single zipped file called MGlogs.zip. The procedure is not lengthy and it will give bjgarrick the information he needs to help you further.

[bjgarrick]

Originally Posted by mfletcher35

Okay, maybe I'm just not seeing it in the instructions. What Files do you want me to attach? I see the part about showing hidden files, but I don't see anything as to what files to attach. Sorry.

As abri stated, Read closer and you will see exactly what I am requesting.

[mfletcher35]

Okay. Thank you. I'm attaching MGlogs.zip. I hope this is what you are looking for.

Mark

[bjgarrick]

First, please disable any antivirus and/or antispy programs you have installed so they will not block this fix.

Step 1:
Please look in Add/Remove Programs for the following and uninstall if found. If you get any errors just make a note and proceed.

AVG Anti-Spyware
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java(TM) 6 Update 2
Java(TM) SE Runtime Environment 6 Update 1
Spybot - Search & Destroy

Step 2:
Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://my.netzero.net/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.net/s/search?r=minisearch

O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

Again, make sure ALL browser windows are closed when you click FIX.

Step 3:
Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

Files to delete:
C:\WINDOWS\checkip.dat
C:\WINDOWS\temp\sqlite~2

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Step 4: Begin here after rebooting from Step 3!
Next Reset Web Settings & Default Security Settings

Note for IE 6 users:
To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites. For IE 7 users, simply click the "Reset all zones to default level" button.

Note for IE 7 users:
Select Internet Options, then the Advanced Tab and then the Reset button under Reset Internet Explorer Settings.


Step 5:
Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.


Step 6:
Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

[mfletcher35]

Sorry it took a few days to get back. I've been traveling on the road and it hasn't been too easy getting an internet connection.

I'm still noticing the netflix ad popping up occasionally. I am also noticing another one from jobs.com.

I am attaching the two logs requested.

Thanks,
Mark

[bjgarrick]

See the threads below and attach a log from each.

Running Rootkit Revealer

Running GMER to detect rootkits

[mfletcher35]

Thank you very much for your continued help and support. I am attaching the two log files.

Mark

[mfletcher35]

Well, I did a little fooling around on my own since posting those two logs. I noticed when I right clicked on a pop-up and clicked on properties it says address nztv.untd.com/webads... Could nztv be short for NetzeroTV? I have Netzero installed on my computer but I never use it. I use the LAN connection or wireless internet. I went to Add/Delete and deleted Netzero. That was several hours ago and I have not had a pop up since. Maybe that was the culprit. I'm keeping my fingers crossed. If anyone else has any other comments or suggestions, my eyes and ears are still open.

Thanks,
Mark

[bjgarrick]

All of your logs look ok so I would say it was something installed such as the program you mentioned.

If you are not having any other malware problems, it is time to do our final steps:

1. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix, you can delete the ComboFix.exe file, C:\ComboFix folder, C:\QooBox folder, C:\WINDOWS\nircmd.exe, C:\combofix.txt and C:\ComboFix-quarantined-files.txt logs that was created.
3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
5. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
6. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
7. If we had you run Avenger, you can delete all files related to Avenger now.
8. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
9. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete C:\MGlogs.zip
10. If you are running Windows XP or Windows ME, do the below:
    • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
    • Then reboot and Enable System Restore to create a new clean Restore Point.
11. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

[mfletcher35]

I haven't had the problem for over 24 hours now. I hope it is solved. Thanks for the "Final Steps" which I will complete now. Thank you so much for all of your help.

Mark

[bjgarrick]

Your Welcome!

Surf Safely!