Pop-ups galore making my little girl cry :(

Hello,


I have been reading this forum for a couple of days now trying to figure out exactly what I have to d oto get rid of the pop-ups I have. I have seen similar issues to mine, but I dont want to mess up anything in my computer just testing out programs im not sure of. Anyhow I have done all the steps in the read me first post, ran all applications and scans (I saw quite a few trojans and adware that were suppoed to be removed). I have a 4 year old daughter who loves playing on noggin online but can't anymore because of all the pop-ups and frankly i'm scared something she should see may pop-up luckily i'm always there and it hasn't. she is actually becoming really good at clicking pop-ups off lol. Anyway can I please ask for some help with this issue so we can play again, I have mainly issues with winfixer, hoowah and a few others frequently poping up. I will attach my hjt file incase anyone has a chance to glance at it. Thank you guys so much it really looks like you help a lot of people all the time with so much and get only minor appreciation. Without people like you many of us would just give up and live with annoying programs such as these and give up when we can't take it anymore. Again thank you guys for helping everyone and I hope that this site is a great stepping stone for a bright future if that is your dream.


Thank You
Jay

 

First, please download Symantec Trojan.Vundo Removal Tool 1.4

*Please follow the instructions very closely to run the tool properly. After you complete the tool reboot and attach a fresh HJT log from normal mode.

 

Thanks for the link. I have been at work a few days now I am just getting on and seeing the reply. I ran the scan and got rid of the trojan.vundo like you suggested. Here is a new hjt log freshly taken.



Thank you again,
Jay

 

Please make sure System Restore is OFF and the Viewing of Hidden Files & Folders is Enabled as per the tutorial.


Please print these instructions out for use in Safe Mode.

Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to extract the files
• This will create a VundoFix folder on your desktop.
• After the files are extracted, please reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.
• Once in safe mode open the VundoFix folder and doubleclick on KillVundo.bat
• You will first be presented with a warning.
  It should look like this

• At this point press enter one time.
  
• Next you will see:

• At this point please type the following file path (make sure to enter it exactly as below!):

C:\WINDOWS\system32\gebyv.dll​

• Press Enter to continue with the fix.
• Next you will see:

• At this point please type the following file path (make sure to enter it exactly as below!):

C:\WINDOWS\system32\vybeg.*​

• Press Enter to continue with the fix.
• The fix will run then HijackThis will open, if it does not open automatically please open it manually.
• In HiJackThis, please place a check next to the following items and click FIX CHECKED:

O2 - BHO: MSEvents Object - {8DBF02DA-4360-4A7E-BEA1-347B87816327} - C:\WINDOWS\system32\gebyv.dll
O20 - Winlogon Notify: gebyv - C:\WINDOWS\system32\gebyv.dll​

• After you have fixed these items, close Hijackthis.
• Press enter to exit the program then manually reboot your computer.

Once your machine reboots please attach a fresh HJT log from normal mode.

 

Hello Again I am back

after I viewed the last message almost a month ago when I went to rebbot to safe mode my cpu went down and I needed to fix a boot error with an xp boot disk i didn't have so now after a friend got me one im finally back. i did everything as instructed in the last post so here is a fresh HJT log. I am still getting pop-ups as I was logging into this site so I know the entire problem isn't finished or a new one started anyhow thanks again for everything.

Jay

 

Please download Spy Sweeper

• Click the link above to download the program.
• Install it. Once the program is installed, it will open.
• It will prompt you to update to the latest definitions, click Yes.
• Once the definitions are installed, click Options on the left side.
• Click the Sweep Options tab.
• Under What to Sweep please put a check next to the following:
  
  • Sweep Memory
  • Sweep Registry
  • Sweep Cookies
  • Sweep All User Accounts
  • Enable Direct Disk Sweeping
  • Sweep Contents of Compressed Files
  • Sweep for Rootkits
  • Please UNCHECK Do not Sweep System Restore Folder.
• Click Sweep Now on the left side.
• Click the Start button.
• When it's done scanning, click the Next button.
• Make sure everything has a check next to it, then click the Next button.
• It will remove all of the items found.
• Click Session Log in the upper right corner, copy everything in that window.
• Click the Summary tab and click Finish.
• Paste the contents of the session log you copied into notepad and save it as spysweeper.txt and attach it to your next post along with a fresh HJT log.

 

Okay, I finished the next step in the quest to end these problems. I will attach both logs and hope that the worst is behind me . Thanks for all the help.


Jay

 

Since Spy Sweeper found so many infections, go back and get any new updates and run a full sweep again to make sure everything was removed. Then attach that log with a fresh HJT log.

 

Ok another fresh sweep was done and it found a lot less than the last time. Here are my results and fresh logs. Is there a foolproof way of preventing these things from attaching to my system? A firewall and virus protection only seems like a false sense of security. Thanks for everything.


Jay

 

Download this trial version of Ewido Security Suite

• First, please download and run CCleaner to clean temp files, cookies, etc; to make the log shorter.
  
• Install ewido security suite
  
• When installing the program, under "Additonal Options" uncheck..
  
  • Install background guard
  • Install scan via context menu
• Launch ewido, there should now be an icon on your desktop, double-click it.
• You will need to update ewido to the latest definition files:
  
  • On the left hand side of the main screen click update.
  • Then click on Start Update.
• The update will start and a progress bar will show the updates being installed.
  (the status bar at the bottom will display "Update successful")

If you are having problems with the updater, you can use this link to manually update ewido. Ewido Manual Updates

• Once the updates are installed, exit Ewido.
• Now print the below instructions or save them locally because I want you to have all browsers closed and also have no connection to the internet (unplug your cable) while doing the below:
• Click on Scanner
• Then click Settings
• Under What to Scan? Select Scan every file
• Then click OK
• Click on Complete System Scan and the scan will start.
• Let the program scan the machine
• While the scan is in progress you will be prompted to clean files that are infected. Leave the defaults selections (to Remove and backup) and click OK. To save yourself some time, you can select Perform action with all infections and then click OK. With the option to scan every file, a lot of cookies will be removed.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report[/size][/color]
• Click Save report
• Save the report to your desktop or anyplace you will be able to find it to upload here.
• Reboot into normal mode and reconnect to the internet.

Once your machine reboots please attach the report from Ewido along with a fresh HJT log from normal mode.

 

Ok here goes nothing I finished the full scan using ewido. I have noticed less pop-ups since i have taken all the steps asked of me (I have done everything posted to me as well as all the things on the stickys) Thanks for all the help, I just never would have thought it takes so much to clear up this problem. I'm amazed how all the cookies and viruses are attracted to a cpu thats rarely used. Again thanks for everything here are my new logs.

 

Please look in Add or Remove Programs for the following and Uninstall them if found:

Ewido

Spy Sweeper

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe

O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

ShowWnd.exe ←–– Search for this file and delete when found!

NEXT:
Run CCleaner to clean up cookies and temp files.

Run full scans with Ad-Aware SE & Spybot S&D and have both programs fix what they find.
Note: Remember to get all updates before doing the scans.

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.


Reboot to Normal Windows , Scan with HijackThis and attach the new log.

 

Ok here is the newest hjt log after i finished all other things I was informed of. Again thank you for all the help over the past month I really appreciate it. When I ran the last scans they came back with none on ad-aware se and two on spybot s&d alot better than any scan I did before. Thank You.

 

Your HJT log is clean, are you currently having any problems?

 

so far so good thank you for everything /salute

 

Your Welcome!

You should see this article on How to Protect yourself from malware!

Surf Safely!