ehg_comcast hitbox fastclick adserver malware problem

chixinixi · Feb 4, 2006

Hi Guys:
Have an HP a 810n running Windows XP. Have an ongoing problem with LOTS of spam and some constant adware. I have run AdAware, Microsoft AntiSpyware and Ewido in safe mode to delete adware but it comes back udner HP-owner cookies. I have taken a look at the running processes online and can't find anything fishy. Can't figure out the problem here. Can you help?

Here is my Hijack This log

Edit by bjgarrick: Unrequested, Inline HJT log removed!

bjgarrick · Feb 4, 2006

Welcome to MajorGeeks.com!

Please follow forum guidelines and perform cleaning steps in the sticky thread before posting HijackThis logs.

Now, please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

http://www.majorgeeks.com/images/grenade.gif Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

http://www.majorgeeks.com/images/grenade.gif Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

http://www.majorgeeks.com/images/grenade.gifAfter doing ALL of the above and you still have a problem, make sure you have booted to normal mode and run the steps in the below thread to properly use HijackThis and attach the log:

http://www.majorgeeks.com/images/grenade.gif Downloading, Installing, and Running HijackThis

chixinixi · Feb 5, 2006

Sorry regarding previous post.
Downloaded and saved hijack this as directed.
What does about:blank issue mean?
Enabled viewing hidden files.
Running Norton antivirus and antispam.
Ran AdAware, Ewido, Microsoft antispyware in Safe Mode. Repaired and Saved log files.
Ewido found doubleclick Hitbox, and tribal fusion cookies which never seem to delete permanently. Similar found with with AdAware. Microsoft antispy found nothing.
Disabled then re enabled system restore.
Hope it's okay to attach reports and HJT log.
Hope you will let me know what you think and advise.

chaslang · Feb 5, 2006

You must complete step 6 of the READ & RUN ME.

I don't know what you are referring too with your question:

What does about:blank issue mean?
Click to expand...

What are you reading?

chixinixi · Feb 5, 2006

Thank You.
Ran Microsoft Windows MalSoftware removal-found nothing.
CWShredder- nothing
Kill2me said fixed look2me infection if present

In HJT under configure
Default screen: About:Blank
Wonder what that means.

Ran Bitdefender (report attached)
Ran Panda Active Scan (report attached)

Please advise.

Thank you most kindly.

chixinixi · Feb 5, 2006

Also ran another HJT log in case it's needed.
Hope it's okay to attach.

chaslang · Feb 5, 2006

Let's get an installed programs list from HijackThis.

Run HijackThis, click Open the Misc Tools section
Click "Open Uninstall Manager"
Click "Save List" (generates uninstall_list.txt)
Click Save, to save it to a file where you can find it.
Upload this file as an attachment too.

chixinixi · Feb 5, 2006

List as requested.
Thank you for your help.

chaslang · Feb 5, 2006

You do not have any real malware problems to be concerned with. You can do the below:

Steps to delete f3initialsetup1.0.0.8.inf:
- Click Start, Run, and enter cmd in the box and click OK. This opens a command prompt windows.
- Enter the following command lines each followed by the enter key
cd C:\WINDOWS\Downloaded Program Files\
attrib -r -h -s f3initialsetup1.0.0.8.inf
del f3initialsetup1.0.0.8.inf
exit

If you were worring about cookies, don't! They are normal and you will always have them unless you never surf. You can just clean the ones you want to remove using CCleaner or similar and keep the ones you want.

chixinixi · Feb 5, 2006

When I hit run cmd OK a screen comes up with
Cocuments and Settings\HP_Owner>

When I hit enter it duplicates itself.

Should I be using another key to move to the next line and do the steps you recommend?

chaslang · Feb 5, 2006

chixinixi said:

When I hit run cmd OK a screen comes up with
Cocuments and Settings\HP_Owner>

When I hit enter it duplicates itself.

Should I be using another key to move to the next line and do the steps you recommend?
Click to expand...

That's just the prompt! Enter the commands I gave you. After the first command (the one with cd) the prompt will change to show the C:\WINDOWS\Downloaded Program Files>

chixinixi · Feb 5, 2006

I think somethng might not be right here (or I am ignorant.)
I cannot type under the line following
Cocuments and Settings\HP_Owner
I hit enter and it moves the curser only to duplicate the same.

I can only type the lines you recommend following the "prompt" , but it doesn't show
C:\WINDOWS\DownloadedProgramFiles>
is not recognized as an internal or external command

When you say "that's just the prompt!" I don't know what that means.

chaslang · Feb 5, 2006

chixinixi said:

I think somethng might not be right here (or I am ignorant.)
I cannot type under the line following
Cocuments and Settings\HP_Owner
I hit enter and it moves the curser only to duplicate the same.

I can only type the lines you recommend following the "prompt" , but it doesn't show
C:\WINDOWS\DownloadedProgramFiles>
is not recognized as an internal or external command

When you say "that's just the prompt!" I don't know what that means.
Click to expand...

When you open the command prompt window, it opens up and displays the current directory that you are in. It does this by having the prompt (the text you are seeing) set to be the current directory followed by the greater than sign (the >). A prompt basically let's you know the computer is ready for to accept you next command. So when you open the command prompt it should show below text and to the right you will enter the first command (which I show in bold):

C:\Documents and Settings\HP_Owner> cd C:\WINDOWS\Downloaded Program Files\

Then you hit the enter key and the prompt should change to:

C:\WINDOWS\Downloaded Program Files>

chixinixi · Feb 5, 2006

Thank you for your patience. I think I got that done properly. What did it do?

chaslang · Feb 5, 2006

If you did all of the commands, it deleted a file in that folder that PandaActiveScan detected. It listed it in your log as:
Code:
 
Potentially unwanted tool:application/funweb    Not disinfected C:\WINDOWS\DOWNLOADED PROGRAM FILES\f3initialsetup1.0.0.8.inf

chixinixi · Feb 5, 2006

I did all of the commands.
What about the other things detected in the Panda file and the other antivirus scan?
Also what do you recommend to get rid of the obnoxious amount of spam I am getting? I have Norton antispam on the highest setting and I am using the setting on the comcast preferences. Can I do anything else?

chaslang · Feb 5, 2006

chixinixi said:

I did all of the commands.
What about the other things detected in the Panda file and the other antivirus scan?
Also what do you recommend to get rid of the obnoxious amount of spam I am getting? I have Norton antispam on the highest setting and I am using the setting on the comcast preferences. Can I do anything else?
Click to expand...

Panda only detected cookies which I alread told you about.

Bitdefender deleted what it found.

Spam is not really malware. If is no different than getting junk paper mail from you mailman everyday. Spam is due to you getting your email address on spam lists. Once you are on one, you wind up on more. Don't ever reply to spam emails. Even when they say click here to be removed. All that does is confirm your email address is valid and you will get more spam. Also be careful who you give you email address to. Spam filtering programs are far from perfect. If you really are annoyed with the spam, don't use that email account anymore for anything. Just get a new email address and don't give it to anyone accept people you really want to have it. Use the one that is getting spammed now for when you order stuff on line or need to give an email address on line to access websites etc. That way all your spam goes to your "spam collector email address" and you just dump most of what comes into it.

chixinixi · Feb 5, 2006

Okay.
Thank you.
I always send the spam to Report As Spam without opening it.
Guess I need to think of a new email address.
Thanks for everything!

chaslang · Feb 5, 2006

chixinixi said:

I always send the spam to Report As Spam without opening it.
Guess I need to think of a new email address.
Thanks for everything!
Click to expand...

You need to open a new email account somewhere. You cannot just change your email address. What do you use for an email account? (like hotmail.com, msn.com, etc).

You're welcome.

chaslang · Feb 5, 2006

Well what I said is not quite correct. Depends on who you get email from. If it is from your ISP. You should be able to change your email user name.

Log in or Sign up

ehg_comcast hitbox fastclick adserver malware problem

chixinixi Private E-2

bjgarrick MajorGeeks Admin - Malware Expert

chixinixi Private E-2

Attached Files:

hijackthis05.log

adaware2506.txt

Scan report_20060205.txt.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chixinixi Private E-2

Attached Files:

Activescan.txt

bdscan1.txt

chixinixi Private E-2

Attached Files:

hijackthis02052206.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chixinixi Private E-2

Attached Files:

uninstall_list.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chixinixi Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chixinixi Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chixinixi Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chixinixi Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chixinixi Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member