popup- bestoffer/ need2find/ altnet

This is not my computer, it is my friends. He is even more computer illiterate than me. He got this computer from a friend. He had no prior experience since a few weeks ago. Anywho.........

He showed it to me, and upon startup, it had a popup. I did adaware, spybot, ccleaner, etc., and it found a trojan, some adware and such. I finally got around to doing a real scan and found a few things.

On the hijack this, I fixed both 08's. I need to know about 018 and 021.

Spybot found nothing and would not let me save a log.

AVG found adware: trymedia.

Bitdefender showed nothing and would not let me save log.

PandaScan showed bestoffer/ need2find/ and altnet. I found a need2find folder. Should I just delete it?

The log didn't save the file name for the other two, what files do I need to remove, or should I run the scan again and get them?

He has blubster. As soon as you start the computer an ad pops up. After the scans, I ran CCleaner and it had a blubster ad cookie (no browsers used).
Thanks again.

 

.......more logs......

 

Please look in Add/Remove Programs for the following and uninstall them if found:

Blubster 2.6.8

Blubster Toolbar

Viewpoint Media Player

Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: Blubster Toolbar Helper - {09AA6C75-179E-42E0-82F7-302603339A82} - C:\Program Files\Blubster Toolbar\v3.0.0.0\Blubster_Toolbar.dll

O3 - Toolbar: Blubster Toolbar - {7EFBC57C-CD57-481F-B794-648FCE9C9116} - C:\Program Files\Blubster Toolbar\v3.0.0.0\Blubster_Toolbar.dll

O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [ShowLOMControl]

O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Blubster] C:\Program Files\Blubster\Blubster.exe SILENT
O4 - HKCU\..\Run: [DellSupport] "C:\PROGRA~1\DELLSU~1\DSAgnt.exe" /startup

O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL

O18 - Filter: text/html - (no CLSID) - (no file)

Again, make sure ALL browser windows are closed when you click FIX.

Now, Please boot into Safe Mode, be sure you have the Viewing of Hidden Files & Folders Enabled per the tutorial. Now, navigate to and DELETE the following if they should remain:

C:\Program Files\Need2Find ← Delete this whole folder if it exist!

C:\Program Files\Viewpoint ← Delete this whole folder if it exist!

C:\Program Files\Blubster ← Delete this whole folder if it exist!

C:\Program Files\Blubster Toolbar ← Delete this whole folder if it exist!


C:\WINDOWS\Blubster_Toolbar_Uninstaller_4171.exe

Next, run CCleaner to clean up cookies and temp files.

After you complete the above, REBOOT and proceed with the rest of this fix...

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Next Reset Web Settings & Default Security Settings

To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.

Note for IE 7 users:
Select Internet Options, then the Advanced Tab and then the Reset button under Reset Internet Explorer Settings.

Finally, I would like you to flush your System Restore points. Please follow the instructions in the below:

• Disable and Re-enable System Restore
  
  
• Turn OFF System Restore to flush any bad Restore Points.
  
  
• Then, follow the instructions at the bottom of the linked page to Re-enable the Restore Utility which will create a fresh restore point.

After you complete the above reboot once more and then scan with HijackThis and attach the new log.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Thank you for your help. I'm sorry it has taken a while for me to get back to you, but he didn't want to remove Blubster. He complained of the slow speed of browsing and other applications so I told him to remove it and if he absolutely wants it, he can always redownload it. So, he did, and he likes the speed now.

I scanned the computer after I followed your instructions, only PandaScan found something.

The first is need2find and the second is best offer. The file names are:

C:\Windows\smdat32m.sys
hkey_current_user\software\Need2Find

Also, when I rebooted from safe mode, the hijackthis found 7 additional R1 and R0 files. IE7 did download/ was upgraded.

 

I got the R1 off, here is the hijack this scan....

If i click the two R0's for deletion, they reappear after I scan after I clicked fix it.

 

Download Pocket KillBox

• Save it to your desktop or a place easy to find.
• Do not run it yet

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme1.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme1.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Locate PocketKillbox
(Procede with this step even if they do not show in blue)

Now, Copy and Paste C:\WINDOWS\smdat32m.sys into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES and allow your PC to reboot.

• If you get an error message about Pending Operations, just reboot your computer manually.

 

Thank you for your help. I ran a PandaScan after I did your instructions, and I'm still showing the Need2Find still there ( hkey_local_machine\software\Need2Find).

Also, the R0's (customize search, and SearchAssisttant), are they from the IE7 upgrade?

 

Click Start > Run > type in regedit

Manually navigate to the following key:

HKEY_CURRENT_USER\Software\Need2Find

Right click on Need2Find and select "Permissions". In the list click on "Everyone" and at the bottom, check the box next to "Full Control. Click OK to exit.

Now right click on "Need2Find" and delete it. If you get any errors let me know!

 

Legit, no threat.