NetPumper :(

Non Serviam · Nov 19, 2006

My various attempts to remove this pernicious piece of malware myself have failed.

Edit by chaslang: Inline HJT log removed. READ & RUN ME sticky not followed.

Non Serviam · Nov 19, 2006

From the above log, I don't recognise this:

O17 - HKLM\System\CCS\Services\Tcpip\..\{61DA6BEA-B8A2-4BE1-B010-CF233F126E0D}: NameServer = 194.74.65.69 194.72.9.34

Accordingly, I've deleted it. It just comes back.

The issue is that every time I start firefox, I get ads (in i.e., not firefox), typically from firstadsolutions. I'm concerned that this is symptomatic of other problems.

Non Serviam · Nov 19, 2006

I'm sorry: Please ignore/delete the thread. Following the standard operating procedure enabled me to fix the problem.

Just in case this helps with diagnosis of future issues with NetPumper -- the malware was hiding in a folder called "Spamwipe" (!) in the Application Data folder. Deleting the folder cured the problem.

chaslang · Nov 19, 2006

Non Serviam said:

Just in case this helps with diagnosis of future issues with NetPumper -- the malware was hiding in a folder called "Spamwipe" (!) in the Application Data folder. Deleting the folder cured the problem.
Click to expand...

But did you remove the registry entry that is trying to load the file:

O4 - HKCU\..\Run: [SOFTMANAGER] C:\DOCUME~1\THERES~1\APPLIC~1\SPAMWI~1\meowreal.exe

Non Serviam · Nov 20, 2006

Yes, I did that. Thanks for pointing it out, though!

chaslang · Nov 20, 2006

You're welcome.

If you are not having any other malware problems, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

NetPumper :(

Non Serviam Private E-2

Non Serviam Private E-2

Non Serviam Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Non Serviam Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member