Still getting pop ups after running Read and Run first

You have a lot more than SpySheriff problems, however, you must run ALL steps in the READ ME not just some of them. In particular I can tell step 6 was not run also was Spybot installed & run.

Are you saying you ran this too: SpySheriff (aka SpywareNo) Removal

 

Here are some of the problems you have:
- multiple trojans
- WinSync
- VCClient
- Look2Me
- Wareout
- E2Give
- Hyperlinker/LinkMaker

 

Are you using Internet Explorer as indicated in the READ ME?
Do you have Active X enabled?

What is the exact error? What about PandaActiveScan?

 

I wanted to know if you had it enabled. I did not want you to disable it. If it is disabled the online scanners will not work. They also will not work if you do not use IE or if you IE version is too old.


Where is your log from PandaActiveScan?

 

For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Note the below will not fix all the problems because there are several other special procedures requires to get all the problems you have fixed. If I put it all in one message it would be extremely long and confusing. So the below will get us started and make a dent in the problems. Then we will continue after you finish these. So don't be surprized when some of these come back and you still have problems afterwards.

Look in Add/Remove programs and uninstall any of the below if found:
E2G or E2Give
VCClient
LinkTracker or QLink or QuickLink or HyperLinker


Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
C:\windows\banmanpro.exe
C:\WINDOWS\system32\pgws.exe
C:\Program Files\Common Files\VCClient\VCClient.exe
C:\Program Files\Common Files\VCClient\VCMain.exe
C:\WINDOWS\system32\cliisa.exe
C:\WINDOWS\system32\cliisa.exe
C:\WINDOWS\system32\igps.exe

After killing all the above processes, click "Back".
Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: LinkTracker Class - {8B6DA27E-7F64-4694-8F8F-DC87AB8C6B22} - C:\Program Files\QL\qlink32.dll
O4 - HKLM\..\Run: [enewsletterpro] C:\windows\enewsletterpro.exe
O4 - HKLM\..\Run: [0o8w0320.dll] RUNDLL32.EXE 0o8w0320.dll,b 471878
O4 - HKLM\..\Run: [banmanpro] C:\windows\banmanpro.exe
O4 - HKLM\..\Run: [drsmartloadb] c:\\drsmartloadb.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\wprpkk.exe reg_run
O4 - HKLM\..\Run: [lspins] "C:\WINDOWS\system32\igps.exe"
O4 - HKLM\..\Run: [dmlwt.exe] C:\WINDOWS\system32\dmlwt.exe
O4 - HKLM\..\Run: [yaemu.exe] C:\WINDOWS\system32\yaemu.exe
O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe
O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe
O4 - HKCU\..\Run: [cliisa] C:\WINDOWS\system32\cliisa.exe
O4 - HKCU\..\RunOnce: [cliisa] C:\WINDOWS\system32\cliisa.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{61F21080-7BE5-4D87-AEB4-239D7BC6BAF2}: NameServer = 85.255.116.109,85.255.112.187
O17 - HKLM\System\CCS\Services\Tcpip\..\{C3A5B10F-8A8F-46B5-8D5C-4BA8AC4F2B58}: NameServer = 85.255.116.109,85.255.112.187
O18 - Filter: text/html - {3551784B-E99A-474f-B782-3EC814442918} - C:\Program Files\QL\qlink32.dll
O20 - Winlogon Notify: CSCSettings - C:\WINDOWS\system32\mvr2l99o1.dll

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\xogo.exe
C:\Documents and Settings\LocalService\Cookies\system@c.enhance[1].txt
C:\Documents and Settings\LocalService\Cookies\system@c.goclick[2].txt
C:\Documents and Settings\melvin\Cookies\melvin@ad.yieldmanager[2].txt
C:\Documents and Settings\melvin\Cookies\melvin@cs.sexcounter[2].txt
C:\Documents and Settings\melvin\Cookies\melvin@perf.overture[1].txt
C:\Documents and Settings\melvin\Cookies\melvin@revenue[1].txt
C:\Documents and Settings\melvin\Cookies\melvin@searchportal.information[1].txt
C:\Documents and Settings\melvin\Cookies\melvin@stats1.reliablestats[2].txt
C:\Documents and Settings\melvin\Cookies\melvin@tribalfusion[2].txt
C:\Program Files\Common Files\VCClient <---- the whole folder
C:\Program Files\E2G <---- the whole folder
C:\Program Files\QL <---- the whole folder
c:\drsmartloadb.exe
C:\winstall.exe
C:\windows\banmanpro.exe
C:\windows\enewsletterpro.exe
C:\WINDOWS\system32\pgws.exe
C:\WINDOWS\system32\cliisa.exe
C:\WINDOWS\system32\igps.exe
C:\WINDOWS\system32\0o8w0320.dll
C:\WINDOWS\system32\wprpkk.exe
C:\WINDOWS\system32\igps.exe
C:\WINDOWS\system32\dmlwt.exe
C:\WINDOWS\system32\yaemu.exe
C:\Program Files\QL\uninstall.exe
C:\secure32.html
C:\WINDOWS\kl.exe
C:\WINDOWS\rdt.ini
C:\WINDOWS\tool2.exe
C:\WINDOWS\SYSTEM32\c000ladm1d0a.dll
C:\WINDOWS\SYSTEM32\csnex.exe
C:\WINDOWS\SYSTEM32\csyiq.exe
C:\WINDOWS\SYSTEM32\data.~
C:\WINDOWS\SYSTEM32\DRIVERS\zpmodemnt.sys
C:\WINDOWS\SYSTEM32\guard.tmp
C:\WINDOWS\SYSTEM32\isa_32.dll
C:\WINDOWS\SYSTEM32\isa_32.exe
C:\WINDOWS\SYSTEM32\l0l6la3s1d.dll
C:\WINDOWS\SYSTEM32\MSDRV.DLL
C:\WINDOWS\SYSTEM32\murd2x40.dll
C:\WINDOWS\SYSTEM32\myricons.dll
C:\WINDOWS\SYSTEM32\o6lulg3916.dll
C:\WINDOWS\SYSTEM32\pwbwv.dat
C:\WINDOWS\SYSTEM32\t0r80a9ued.dll

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
Now run Ccleaner (installed while running the READ ME FIRST).

Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

Reminder Note: Once we have determine you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

Please complete part of my last message:

It pays to double check that everything is fixed. And I don't think you are finished yet.

 

Your log is clean. If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

After that, you should work thru the below link:

How to Protect yourself from malware!