Adware Problem

well after 24 hours I appeal to you malware-contents.
I have followed the directions in the latest "Read and Run Me First".
I have attached the HJT log.
This line from the log seems suspicious to me
"O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe",

but I dont see the way to just delete 1 item after a HJT scan.

I have also attached the "(a-squared) Report.txt"

I have a AMD Athlon
Windows 2000 Service Pack 4
768 MB RAM.

I really appreciate what you guys are doing and I look forward to solving this gnarly problem

 

Download this trial version of Ewido Security Suite

• Install ewido security suite
• Launch ewido, there should be an icon on your desktop double-click it.
• The program will have a window come up. One of the buttons on the left is to Update. Click the Update button.and then Start the Update. The update will start and a progress bar will show the updates being installed.
• After it completes the update, click the Scanner button

Now exit Ewido. Now print the below instructions or save them locally because I want you do have no browsers opened and also have no connection to the internet (unplug your cable) while doing the below.

Okay, reboot into safe mode and follow the steps below. (If you have any problems at all trying to get into safe mode to complete these steps, just run them in normal boot mode and make sure you tell me when you come back.)

Open up Ewido and do the following:

• Click on Scanner
• Then click Settings
• Under What to Scan? Select Scan every file
• Then click OK
• Click on Complete System Scan and the scan will start.
• Let the program scan the machine

While the scan is in progress you will be prompted to clean files that are infected. Leave the defaults selections (to Remove and backup) and click OK. To save yourself some time, you can select Perform action with all infections and then click OK. With the option to scan every file, a lot of cookies will be removed.

Once the scan has completed, there will be a button located on the bottom of the screen named Save report

• Click Save report
• Save the report to your desktop or anyplace you will be able to find it to upload here.

Reboot into normal mode and reconnect to the internet.

Come back here and post the Ewido Scan Report along with a fresh HJT log.

 

BJ- thanks for replying so quickly.
Here are the updated files.

 

I hate to be picky but could you attach a fresh HJT log without the MD5, will make it a lot easier to sort out.

 

here you go.

someday I would like to know 1/2 of what I suspect you know about malware

 

Please look in Add or Remove Programs for the following and Uninstall them if found:

Microsoft AntiSpyware

Ewido

Vbouncer or Virtual Bouncer

Please make sure System Restore is OFF and the Viewing of Hidden Files & Folders is Enabled as per the tutorial.


Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local.,

O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Navigate to and DELETE the following if they should remain:

C:\Program Files\VBouncer ←–– Delete this whole folder if it exist!

NEXT:
Run CCleaner to clean up cookies and temp files.

Run full scans with Ad-Aware SE & Spybot S&D and have both programs fix what they find.
Note: Remember to get all updates before doing the scans.


Reboot to Normal Windows , Scan with HijackThis and attach the new log.
Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

Good Luck!

 

Removed Microsoft AntiSpyware and Ewido.

Vbouncer or Virtual Bouncer not found in Add/Remove Programs.

System Restore does not apply since I run W2000.

Ran all the scans as instructed.

Attached HJT log.

Had a few ads pop up immediately on launching browser.
Bit seems amount and frequency of pop-up ads and browser windows is decreased.

Do you see anything else?

Thanks

 

Your HJT log is clean, are you having any current problems?

 

Yes, unfirtunately.
Right now I am looking at pop-up ads of "Screensaver.com", "Venus123". "System Status: Your Urggent Attention is Required", "Whose legs are these" (All of those are sort of half of a webpage, without any identifying URL) and then a webpage:
<http://www.circuitcity.com/ccd/genericContent.do?oid=134277&WT.mc_n=101255&WT.mc_t=U&cm_ven=CONTENT%20SITE&cm_cat=ADVERTISING.COM&cm_pla=WEEKLY%20INITIATIVES->HOME%20ENTERTAINMENT&cm_ite=38483%20HOME%20ENTERTAINMENT_ABETTERLOOKINGTV_BEST&cm_keycode=101255>

 

Have you ran full scans with Ad-Aware & Spybot with all updates?

 

Yes I have

 

Please Download TrojanHunter 4.2

• Install TrojanHunter, At the end of the install setup will prompt you to update definitions. Click YES to update TH!

• Once installed and updated, select drive C:\ and do a Full Scan. Remove all found infections.

• After you have completed the scan and removed all found infections reboot and attach a fresh HJT log.

 

I just noticed there is a new patch for Ad-Aware released today.
And it seems like maybe I need to upgrade Spybot as well.
I was pretty sure I had the latestm but I guess niot.
Sorry

 

OK-
Followed your instructions.
Here is latest HJT scan (run with MD5 checked).

I'm still getting pop-up ads- (currently "Should Marijuana Be Legalized", "Endless Pools")

 

Generate a StartupList log using HijackThis.
Run HJT and on the first screen, click the button that says "Open the Misc Tools section". In the next window first select "List also minor sections (full)" and then click the button that says "Generate StartupList log". CLick Yes to the Do you want to continue prompt. Now a notepad window will come up with the Startuplist.txt file. It is already saved in the the directory HJT is running from. So just come back here and upload the file as an attachment to your next message.

Also attach a new HJT log without the MD5.

 

Here they are

 

bjgarrick-

please see another thread i started related to this one

<http://forum.majorgeeks.com/showthread.php?p=670878#post670878>

thanks

 

BJ- here is the entire PandaScan log.

It ddin't occur to me to post it previously.

 

Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

C:\Program Files\Common Files\wzrm ←–– Delete this whole folder if it exist!

NEXT:
Run CCleaner to clean up cookies and temp files.


After you complete the above, reboot and let me know how things are running.

 

followed your suggestions.
I'm still often getting a pop-up ad from "E-Pilot" and occasionally others

 

When do you get the popups, while surfing? Just sitting there?

 

Both

 

let me elaborate.
sometimes i will get the pop-up while just sitting there.
sometimes when i surf i notice the pop-up ad seems to have something to do with the webpage i have surfed to.
I remember one instance where I surfed to a page about a hotel and got a pop-up ad advertising other hotels.
It seems this type of pop-up has happened several times. I have been on the lookout as to whether there is a connection.
But sometimes the pop-up ad seems to have little or nothing to do with the website I have surfed to

 

Please download Spy Sweeper 4.5.3.560

• Install SpySweeper, make sure you get the updated spyware definitions before doing anything else.

• After you have downloaded the updates do a full sweep removing all infections. After you removed the infections with SpySweeper, reboot and attach a fresh HJT log!

*Also let me know if anything was found.

 

It wants a serial number to install

 

I d/l the free trial update from webroot website.
I ran it and it found 24 cookies and 3 adware.
I removed them, restarted and then ran Spy Sweeper again and it found nothing.
I have attached the latest HJT log

 

I may be posting this prematurely but I have gone about 1 hour without any pop-up ads.
So possibly Spy Sweeper did the trick.
Will keep you posted if this changes.
Thanks so mch for your help.
Your website and the gurus running it are doing a miraculous job in educating and helping users fend off this brand of terrorism

 

When I first ran Spy Sweeper I didn't notice the option to save a log.
But now I see how to do it and I am attaching it just in case it is helpful to you.
I am still running ad free.

 

I just had to post one more time how "thrilling" it is to run ad-free.
Mal-ware is definitely bad for the nervous system.

 

Your HJT log is clean, your SpySweeper log is pretty bad which was most likely the cause of your popups.

Are you having any further problems?

 

NO!!
Thank goddess and BJ!!

 

You should see this article on How to Protect yourself from malware!

Surf Safely!