Pop up Problems

I am getting popups everywhere. I have gone through all of the steps recommended on this site and still can't see to fix the problem.

I am attaching my hijack log. I'm not sure what should be deleted.

Thanks for your help.

 

Download this trial version of Ewido Security Suite

• Install ewido security suite
• Launch ewido, there should be an icon on your desktop double-click it.
• The program will have a window come up. One of the buttons on the left is to Update. Click the Update button.and then Start the Update. The update will start and a progress bar will show the updates being installed.
• After it completes the update, click the Scanner button

Now exit Ewido. Now print the below instructions or save them locally because I want you do have no browsers opened and also have no connection to the internet (unplug your cable) while doing the below.

Okay, reboot into safe mode and follow the steps below. (If you have any problems at all trying to get into safe mode to complete these steps, just run them in normal boot mode and make sure you tell me when you come back.)

Open up Ewido and do the following:

• Click on Scanner
• Then click Settings
• Under What to Scan? Select Scan every file
• Then click OK
• Click on Complete System Scan and the scan will start.
• Let the program scan the machine

While the scan is in progress you will be prompted to clean files that are infected. Leave the defaults selections (to Remove and backup) and click OK. To save yourself some time, you can select Perform action with all infections and then click OK. With the option to scan every file, a lot of cookies will be removed.

Once the scan has completed, there will be a button located on the bottom of the screen named Save report

• Click Save report
• Save the report to your desktop or anyplace you will be able to find it to upload here.

Reboot into normal mode and reconnect to the internet.

Come back here and post the Ewido Scan Report along with a fresh HJT log.

 

Thank you for your help. I have run the ewido check.

Please let me know what to do now.

 

Please look in Add or Remove Programs for the following and Uninstall them if found:

Ewido

- Now please download, install and update Spy Sweeper Run it once while you are in normal boot mode.

- The boot in safe mode from and run SpySweeper one more time.

Now reboot in normal mode.

Save and attach the logs from both runs.

 

I just finished running the spy sweeper twice. After the first time I clicked "restart computer" before I saved the log (Duh). I have attached the second log. Let me know if I need to run it again and get you another log.

 

Attach a fresh HJT log from normal mode.

 

here's a new hjt log.

 

Please look in Add or Remove Programs for the following and Uninstall them if found:

Spy Sweeper


Please EXTRACT HijackThis from the ZIP File to a Safer location. Here's how:

To create a new folder:

• Click START > My Computer > Local Disc C: > Program Files
• Now, Right Click on an Empty Area and select New > Folder & name it HijackThis and ENTER

To Extract HijackThis:

• Now, Right Click your HijackThis ZIP File and select Extract All > Next > and browse to your newly created HijackThis Folder
• (C:\Program Files\HJT) and click Next.

After you have completed the above steps to relocate HJT, run it from the new location. Please save your HJT log as a .txt file and attach it via the "Manage Attachments" tool in the Additional Options section when you post.

The reason HJT needs its own safe folder is so that backups will be safely preserved. That way, if a mistake is made in the removal process, the mistakenly deleted entry can be restored.

 

Here is a new version of the highjack file.

 

Scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O20 - Winlogon Notify: policies - C:\WINDOWS\
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\U3BlbmNlcgAA\command.exe (file missing)

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Click Start > Run > type services.msc and Click OK

Locate Command Service (cmdService) and RightClick on it to bring up the Service Properties Window.
First: Stop the service by clicking the Stop Button.
Next: Disable it by changing the Startup Type to Disabled and click Apply

NEXT:
Run CCleaner to clean up cookies and temp files.


After you complete the above, reboot and attach a fresh HJT log.

 

Thanks again for all of this help. Here's an update highjack log.

 

Your HJT log is clean, are you having any further problems?

 

The pop up problem has now stopped. I can't tell you how much I appreciate all of your help.

 

Your Welcome!

You should see this article on How to Protect yourself from malware!

Surf Safely!

 

Hello again,

After two popup-free weeks, I am getting popups again. Please help!

Thanks.

 

Your HJT log shows no signs of infections, lets see what SS can come up with.

Please download Spy Sweeper

• Click the link above to download the program.
• Install it. Once the program is installed, it will open.
• It will prompt you to update to the latest definitions, click Yes.
• Once the definitions are installed, click Options on the left side.
• Click the Sweep Options tab.
• Under What to Sweep please put a check next to the following:
  
  • Sweep Memory
  • Sweep Registry
  • Sweep Cookies
  • Sweep All User Accounts
  • Enable Direct Disk Sweeping
  • Sweep Contents of Compressed Files
  • Sweep for Rootkits
  • Please UNCHECK Do not Sweep System Restore Folder.
• Click Sweep Now on the left side.
• Click the Start button.
• When it's done scanning, click the Next button.
• Make sure everything has a check next to it, then click the Next button.
• It will remove all of the items found.
• Click Session Log in the upper right corner, copy everything in that window.
• Click the Summary tab and click Finish.
• Paste the contents of the session log you copied into notepad and save it as spysweeper.txt and attach it to your next post along with a fresh HJT log.

 

The trial subscription I got to Spy Sweeper when I was having problems a couple of weeks ago has run out. Is there another program I can use?

 

Have you downloaded this newest version?

 

Here is a new hijack report as well as a spy sweeper report in both normal and safe mode.

Thanks.

 

Here's the highjack log.

 

Download AproposFix by Swandog46

Save it to your desktop or to another folder of its own, but do NOT run it yet!

Now reboot your computer in Safe Mode! (You must be in safe mode or this fix will not work.)

Once in Safe Mode, double-click aproposfix.exe which will give you a chice of where to unzip/install the program to). This is called the Destination folder in the window that popsup. So either install it to the Desktop or the folder where you downloaded the aproposfix.exe file to. It will create a new folder named aproposfix. Open the aproposfix folder and double click on RunThis.bat to run the fix. Follow the prompts.

When the tool is finished, reboot back into normal mode, and post a new HijackThis log, along with the entire contents of the log.txt file that has been created in the aproposfix folder.

 

Here you go...

 

Run post #16 again, get the latest updates again run another full sweep then attach that log.

 

Here is my updated SS log. Thanks for your help.

 

Download AproposFix by Swandog46

Save it to your desktop or to another folder of its own, but do NOT run it yet!

Now reboot your computer in Safe Mode! (You must be in safe mode or this fix will not work.)

Once in Safe Mode, double-click aproposfix.exe which will give you a chice of where to unzip/install the program to). This is called the Destination folder in the window that popsup. So either install it to the Desktop or the folder where you downloaded the aproposfix.exe file to. It will create a new folder named aproposfix. Open the aproposfix folder and double click on RunThis.bat to run the fix. Follow the prompts.

When the tool is finished, reboot back into normal mode, and post a new HijackThis log, along with the entire contents of the log.txt file that has been created in the aproposfix folder.

 

Here is the apropros log and a new highjack this log.

 

Open Spy Sweeper and click on Results. Now click on the Session Log tab and click Clear Session History. Now click on Quarantine and select all and delete.

Now go back to post #16 and run one more full sweep and attach the new log from SS along with a fresh HJT log.

 

Here you go.

 

Please make sure System Restore is disabled before we continue the cleaning process!

Please download Rootkit Revealer 1.56

For help with this utility please see the site below...
http://www.sysinternals.com/Utilities/RootkitRevealer.html

After you complete a scan, attach the log to your next post.

 

Here is the rootkit log.

 

Run CCleaner to clean up cookies and temp files.

Next, run Windows XP Prefetch Clean And Control 1.2.0 to clean the Prefetch folder. Once download is complete, double click to open, click the button "Clean Prefetch Folder Now" then exit the utility.

After you complete the above, download Blacklight to its own folder...

F-Secure Blacklight

After download is complete, double click to run the program. Click "Accept" to procede. Then click SCAN to begin scanning your system.

Once the scan is complete it will attempt to clean the found infections. There should be a log in the folder that you ran the program from, attach this log to your next post.

 

Blacklight said no hidden files were found. Here is the log.

Thanks.

 

Good, now attach a current HJT log from normal mode.

 

Here is the HJT log.

 

Click Start > Run > type services.msc and Click OK

Locate Plug and Play Device Manager ($sys$DRMServer) and RightClick on it to bring up the Service Properties Window.
First: Stop the service by clicking the Stop Button.
Next: Disable it by changing the Startup Type to Disabled and click Apply

Locate XCP CD Proxy (CD_Proxy) and RightClick on it to bring up the Service Properties Window.
First: Stop the service by clicking the Stop Button.
Next: Disable it by changing the Startup Type to Disabled and click Apply

Now scan with HijackThis and Check the Boxes for the following:

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: KIFGTLU - Unknown owner - C:\DOCUME~1\Spencer\LOCALS~1\Temp\KIFGTLU.exe (file missing)
O23 - Service: ONR - Unknown owner - C:\DOCUME~1\Spencer\LOCALS~1\Temp\ONR.exe (file missing)

Make sure All Browser Windows are Closed when you Click FIX.

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

C:\WINDOWS\system32\$sys$filesystem ←–– Delete this whole folder if it exist!

C:\WINDOWS\CDProxyServ.exe

NEXT:
Run CCleaner to clean up cookies and temp files.

Run full scans with Ad-Aware SE & Spybot S&D and have both programs fix what they find.
Note: Remember to get all updates before doing the scans.

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.


Reboot to Normal Windows , Scan with HijackThis and attach the new log.
Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Thanks for the help. I didn't have any problems with the instructions. I am no longer having pop up problems but it does seem like my entire computer has been running slower lately. Hopefully those things I just deleted will help that.

 

Your HJT log is clean, you can uninstall Ewido & Spy Sweeper to run a little faster. Also note that McAfee is a resource hog, AVG carries a much smaller footprint and does a better job in my opinion.

If you would like to remove some unnecessary entries you can remove the below.

O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ISUSScheduler] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe

 

Thanks for all of your help. I have one more question. You mentioned using AVG instead of McAfee. What is AVG?

Thanks.

 

AVG AntiVirus, its a free antivirus that does in my opinion a better than job that most AV programs you can buy. It also has a smaller footprint meaning is uses less resources and takes up less space.

AVG Free Edition 7.1.371

 

Should I uninstall McAfee or just turn it off?

 

If you install AVG you will need to uninstall McAfee.