Too many pop ups called 680180.net taking over computer

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by tdfrank@comcast.net, Jul 31, 2004.

  1. tdfrank@comcast.net

    tdfrank@comcast.net Private E-2

    I am running windows 2000 service pack 4.
    Recently my computer has been hijacked by spyware. I am running adaware almost continually - several times a day. The problem has gotten better; however I still get this one pop up all the time called 680180.net. If I minimize it I can keep doing what ever I'm doing online, but if I try to close it, it makes me "End Task" and closes all of my browser windows. HOW FRUSTRATING!!! :rolleyes:

    I did a google search on 680180.net and ran across a post from someone asking someone else to run hijackthis and post their log. I am not posting my log since you have specifically said not to. But I would really like some help in getting rid of this problem once and for all. I am really afraid that this pop up is a caused by a trojan and is stealing my personal info.

    Thank you in advance for your help.

    Additional Info:
    I am running IE 6
    I recently installed the Google toolbar because of the pop up blocker, but it hasn't stopped a single pop up yet - should I remove this?
    PIII 500Mhz, 6mb hd, 128mb RAM
     
    tdfrank@comcast.net, Jul 31, 2004
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Please do the following:

    - run this online scan (and select Auto Clean): http://housecall.trendmicro.com/housecall/start_corp.asp
    - Download, install, and UPDATE (but do not scan yet) SpyBot S&D: http://www.majorgeeks.com/download2471.html
    The first thing you need to do with SpyBot is fix a some settings. At the top of the screen select Mode, Advanced mode, then on the lower left select Settings. Now select Ignore Products. Right click on lower part of the right window and select "Deselect all". Close SpyBot down (we will run later).
    - as Neo said make sure your Ad-aware is updated. You should have version 6.0 build 6.181 and your reference file version should be 01R334 24.07.2004. If you don't have these update to them.
    - then learn how to set Ad-aware to do a full scan: http://www.lavahelp.com/howto/fullscan/index.html but don't scan yet.
    - boot into safe mode: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec_doc_nam
    - run Ad-aware full scan a make sure you fix what it finds.
    - run SpyBot S&D and fix what it finds.

    Report back how this worked and what they found.
    If still having problems download and unzip HijackThis to it's own directory (not your Desktop or a temp folder). Get HijackThis here: http://www.majorgeeks.com/download3155.html
    Read the information in this link http://forums.majorgeeks.com/showthread.php?t=35407 on using HijackThis and follow the directions on shutting down ALL applications before running. And then run, save a log (save it as a .txt file rather than a .log file). Now ATTACH it to your message as directed in the link.
     
    chaslang, Jul 31, 2004
    #2
  3. tdfrank@comcast.net

    tdfrank@comcast.net Private E-2

    As I was sitting here typing in what a great job all of this did and telling you guys Thank You, I started getting those popups again!! How frustrating! :mad: I also kept getting a file dowload, install and run dialog for shdocvw.dll. Of course I said cancel, but it was right after it happened the second time that the 680180 popups started happening again.

    the online scan found the following:
    these are all preceded with TROJ:
    vb.dx
    small.xc
    briss.a
    scthought.z
    small.iq
    agent.ae
    small.gm
    imiserv.c
    and...
    BKDR sandbox.a
    JS noclose.aa

    I'm attaching the logs for Ad-aware and Spybot.
    Thank you for your help! I'm going to run hijackthis again and I'll attach the log when that's done.
     

    Attached Files:

    tdfrank@comcast.net, Aug 1, 2004
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I need to see that HijackThis log. Make sure you get the new version of HijackThis that just came out:
    http://www.majorgeeks.com/download3155.html

    In the meantime, I also saw SpyHunter in your Ad-aware log. Get rid of SpyHunter (uninstall it) if you still have it on your PC.

    Did you have Ad-aware fix all the items it found? There were a bunch of things wrong.
     
    chaslang, Aug 1, 2004
    #4
  5. soj

    soj Private E-2

    hi my friend is having the same problem here is her hijack log, can you help?????
     
    Last edited by a moderator: Sep 4, 2004
    soj, Sep 4, 2004
    #5
  6. Major Attitude

    Major Attitude Co-Owner MajorGeeks.Com Staff Member

    If you can not use Hijack This, how do you propose to help this person? Please search these forums and read the sticky threads and if that does not help start your own thread, not hijack someone elses. Had you read a few threads, you would not have posted a log file. Were glad to help, but you must take the first steps on your own. :)

    Starting places:

    http://forums.majorgeeks.com/showthread.php?t=35407

    http://forums.majorgeeks.com/showthread.php?t=38752


     
    Major Attitude, Sep 4, 2004
    #6

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds