popup problems.. ebloc, ad1, spotter

Discussion in 'Computer Support' started by jvco777, Jul 30, 2004.

  1. jvco777

    jvco777 Guest

    Here is a log of hijack this. I'm having severe problems with my
    browser wherein popups just keep coming out. I've ran adaware and
    spybot and both have been updated. Also I have spyguard and
    spywareblaster installed as well. However, i'm still experiencing
    these problems and am getting really annoyed at these companies. If
    anyone can take a look at my log and tell me whats wrong w/ my PC i
    would really appreciate it. Also I notice that before that popup
    comes out a window with title "c.azjmpr" comes out.

    Logfile of HijackThis v1.98.0
    Scan saved at 10:44:47 AM, on 7/30/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\WINNT\system32\rundll32.exe
    C:\WINNT\Explorer.EXE
    C:\WINNT\System32\Ati2evxx.exe
    C:\Program Files\NavNT\defwatch.exe
    C:\WINNT\System32\gearsec.exe
    C:\WINNT\system32\HPConfig.exe
    C:\Program Files\netOctopus Agent\Nant.exe
    C:\WINNT\System32\cvss.exe
    C:\Program Files\NavNT\rtvscan.exe
    C:\WINNT\system32\dla\tfswctrl.exe
    C:\WINNT\System32\atiptaxx.exe
    C:\WINNT\system32\RadioSvr.exe
    C:\WINNT\System32\svchost.exe
    C:\PROGRA~1\HEWLET~1\ONE-TO~1\OneTouch.EXE
    C:\Program Files\RealVNC\WinVNC\WinVNC.exe
    C:\Program Files\Hewlett-Packard\HP Notebook Utilities\hptasks.exe
    C:\WINNT\System32\carpserv.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\NavNT\vptray.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\netOctopus Agent\nantsecc.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINNT\System32\ctfmon.exe
    c:\progra~1\intern~1\iexplore.exe
    c:\progra~1\intern~1\iexplore.exe
    C:\Program Files\SpywareGuard\sgmain.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINNT\System32\MsgSys.EXE
    C:\Program Files\SpywareGuard\sgbhp.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\jv\HijackThis.exe

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant
    = http://www.pxnggvdgylirdxbilrq.org/...8//GYnAMLxVK83EFOn_pM9sbchte333/9MAStQbZm.htm
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch
    =
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
    http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
    R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
    http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
    R3 - URLSearchHook: WebSearch Class -
    {9368D063-44BE-49B9-BD14-BB9663FD38FC} - C:\Program
    Files\se\v11\se.DLL (file missing)
    N3 - Netscape 7: user_pref("browser.startup.homepage",
    "http://home.netscape.com/"); (C:\Documents and
    Settings\Administrator\Application
    Data\Mozilla\Profiles\default\4nyet4pe.slt\prefs.js)
    N3 - Netscape 7: user_pref("browser.search.defaultengine",
    "http://www.google.com/"); (C:\Documents and
    Settings\Administrator\Application
    Data\Mozilla\Profiles\default\4nyet4pe.slt\prefs.js)
    O1 - Hosts: 69.20.16.183 ieautosearch
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -
    c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [dla] C:\WINNT\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS
    Software\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
    O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HEWLET~1\ONE-TO~1\OneTouch.EXE
    O4 - HKLM\..\Run: [HP TV Now] C:\Program Files\Hewlett-Packard\HP TV
    Now\HpTvNow.exe /RK
    O4 - HKLM\..\Run: [HP Display Settings] C:\Program
    Files\Hewlett-Packard\HP Notebook Utilities\hptasks.exe /s
    O4 - HKLM\..\Run: [CARPService] carpserv.exe
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program
    Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program
    Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
    Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NANTSessionAgent] C:\Program Files\netOctopus
    Agent\nantsecc.exe
    O4 - HKLM\..\Run: [WinVNC] "C:\Program
    Files\RealVNC\WinVNC\WinVNC.exe" -servicehelper
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program
    Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
    Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Search-Exe] "C:\Program Files\se\v11\se.EXE" /H
    O4 - HKLM\..\Run: [bleheq] C:\PROGRA~1\AIMHOL~1\modetestacid.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\System32\ctfmon.exe
    O4 - Startup: SpywareGuard.lnk = C:\Program
    Files\SpywareGuard\sgmain.exe
    O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program
    Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common
    Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: MA111 Configuration Utility.lnk = C:\Program
    Files\NETGEAR\MA111 Configuration Utility\wlancfg.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
    Office\Office10\OSA.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program
    files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: Backward &Links - res://c:\program
    files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page -
    res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel -
    res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Si&milar Pages - res://c:\program
    files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English -
    res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD}
    - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger -
    {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program
    Files\Yahoo!\Messenger\yhexbmes0411.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} -
    C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}
    - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger -
    {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
    Files\Messenger\MSMSGS.EXE
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
    http://207.188.7.150/04fd01202ffc7955d500/netzip/RdxIE601.cab
    O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) -
    http://www.stopzilla.com/_download/Auto_Installer/dwnldr_ext.cab

    Thank You

    JV
    jvco777, Jul 30, 2004
    #1
    1. Advertising

  2. jvco777

    °Mike° Guest

    Before you proceed, make sure that you have
    SpyBot S&D and Ad-Aware updated.

    Be sure to download and install the Ad-Aware
    VX2 cleaner plug-in
    http://www.lavasoftusa.com/software/plugins/vx2cleaner.shtml

    Download LSP-Fix (IMPORTANT).
    http://cexx.org/lspfix.htm

    Download SpHjfix fix.
    http://www.trojaner-info.de/cgi-bin/download.cgi?file=sphjfix

    Download AboutBuster
    http://tools.zerosrealm.com/AboutBuster.zip

    Download CWShredder
    http://www.spywareinfo.com/~merijn/cwschronicles.html


    Boot into Safe Mode once that's done. As soon as you
    have booted into Safe Mode, empty your TEMP folder,
    your Temporary Internet Files (including Offline Content),
    and your IE History.


    Continued inline ....


    On 30 Jul 2004 10:54:28 -0700, in
    <>
    jvco777 scrawled:

    >Here is a log of hijack this. I'm having severe problems with my
    >browser wherein popups just keep coming out. I've ran adaware and
    >spybot and both have been updated. Also I have spyguard and
    >spywareblaster installed as well. However, i'm still experiencing
    >these problems and am getting really annoyed at these companies. If
    >anyone can take a look at my log and tell me whats wrong w/ my PC i
    >would really appreciate it. Also I notice that before that popup
    >comes out a window with title "c.azjmpr" comes out.
    >
    >Logfile of HijackThis v1.98.0
    >Scan saved at 10:44:47 AM, on 7/30/2004
    >Platform: Windows XP SP1 (WinNT 5.01.2600)
    >MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)



    DO THIS IN SAFE MODE
    =================

    DISCONNECT FROM THE NET
    =====================

    CLOSE ALL OTHER APPLICATIONS EXCEPT HJT
    ==================================


    >R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    >http://www.pxnggvdgylirdxbilrq.org/...8//GYnAMLxVK83EFOn_pM9sbchte333/9MAStQbZm.htm


    >R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=


    >R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
    >http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=


    >R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
    >http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=


    >R3 - URLSearchHook: WebSearch Class -
    >{9368D063-44BE-49B9-BD14-BB9663FD38FC} - C:\Program
    >Files\se\v11\se.DLL (file missing)


    >O1 - Hosts: 69.20.16.183 ieautosearch


    >O4 - HKLM\..\Run: [Search-Exe] "C:\Program Files\se\v11\se.EXE" /H


    Have HijackThis fix the above entries.


    >O4 - Startup: SpywareGuard.lnk = C:\Program
    >Files\SpywareGuard\sgmain.exe


    **** As I have always maintained, SpywareGuard is
    crap, and it is NOT protecting your system.


    >O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll
    >O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll
    >O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll
    >O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    >O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    >O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    >O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    >O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll


    Have HijackThis fix the above, and then (IMPORTANT),
    run LSP-Fix.


    Open your registry editor (Start / Run / Regedit) to:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    If you see an entry named '__NS_Service_3' delete it.

    Still in the registry, navigate to:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root
    If you see an entry named 'LEGACY___NS_Service_3' delete it.

    Close your registry editor.

    Do NOT reconnect; do NOT reboot into normal mode, yet.

    Run SpyBot S&D (full scan)

    Run Ad-Aware (full scan)

    Run the Ad-Aware VX2 cleaner plug-in.

    Run the SpHjfix.

    Run CWShredder

    Run AboutBuster

    Re-run HijackThis and rescan.


    If SpyBot S&D and/or Ad-Aware do not run in Safe
    Mode, leave those steps until last and run them
    in normal mode, BEFORE YOU CONNECT.


    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
    °Mike°, Jul 30, 2004
    #2
    1. Advertising

  3. jvco777

    °Mike° Guest

    On Fri, 30 Jul 2004 22:54:37 GMT, in
    <NkAOc.583$>
    JB scrawled:

    >Mike you superseed yourself again, READ "I've ran adaware and spybot and
    >both have been updated" miss that did you,


    There was no mention of *when* they were updated. Now, is
    there anything else that you'd like to pick at?

    >If you want to avoid doing all that then back up your personal data and
    >reinstall your operating system, this procedure will take less time and you
    >are guaranteed a clean machine, well at least until you download and install
    >more freeware crap


    Jimmy, you really should stay off the pop. I do NOT need to
    "avoid doing all that", neither do I need to reinstall my operating
    system; neither does the OP, for that matter.

    If you're going to reply, at least reply to the correct person.


    >"°Mike°" <> wrote in message
    >news:...
    >> Before you proceed, make sure that you have
    >> SpyBot S&D and Ad-Aware updated.
    >>
    >> Be sure to download and install the Ad-Aware
    >> VX2 cleaner plug-in
    >> http://www.lavasoftusa.com/software/plugins/vx2cleaner.shtml
    >>
    >> Download LSP-Fix (IMPORTANT).
    >> http://cexx.org/lspfix.htm
    >>
    >> Download SpHjfix fix.
    >> http://www.trojaner-info.de/cgi-bin/download.cgi?file=sphjfix
    >>
    >> Download AboutBuster
    >> http://tools.zerosrealm.com/AboutBuster.zip
    >>
    >> Download CWShredder
    >> http://www.spywareinfo.com/~merijn/cwschronicles.html
    >>
    >>
    >> Boot into Safe Mode once that's done. As soon as you
    >> have booted into Safe Mode, empty your TEMP folder,
    >> your Temporary Internet Files (including Offline Content),
    >> and your IE History.
    >>
    >>
    >> Continued inline ....
    >>
    >>
    >> On 30 Jul 2004 10:54:28 -0700, in
    >> <>
    >> jvco777 scrawled:
    >>
    >> >Here is a log of hijack this. I'm having severe problems with my
    >> >browser wherein popups just keep coming out. I've ran adaware and
    >> >spybot and both have been updated. Also I have spyguard and
    >> >spywareblaster installed as well. However, i'm still experiencing
    >> >these problems and am getting really annoyed at these companies. If
    >> >anyone can take a look at my log and tell me whats wrong w/ my PC i
    >> >would really appreciate it. Also I notice that before that popup
    >> >comes out a window with title "c.azjmpr" comes out.
    >> >
    >> >Logfile of HijackThis v1.98.0
    >> >Scan saved at 10:44:47 AM, on 7/30/2004
    >> >Platform: Windows XP SP1 (WinNT 5.01.2600)
    >> >MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    >>
    >>
    >> DO THIS IN SAFE MODE
    >> =================
    >>
    >> DISCONNECT FROM THE NET
    >> =====================
    >>
    >> CLOSE ALL OTHER APPLICATIONS EXCEPT HJT
    >> ==================================
    >>
    >>
    >> >R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

    >>
    >>http://www.pxnggvdgylirdxbilrq.org/GpPJB8iGyUzvR0/1jve1KDq8//GYnAMLxVK83EFO

    >n_pM9sbchte333/9MAStQbZm.htm
    >>
    >> >R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=

    >>
    >> >R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =

    >>
    >>http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
    >>
    >> >R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) =

    >>
    >>http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
    >>
    >> >R3 - URLSearchHook: WebSearch Class -
    >> >{9368D063-44BE-49B9-BD14-BB9663FD38FC} - C:\Program
    >> >Files\se\v11\se.DLL (file missing)

    >>
    >> >O1 - Hosts: 69.20.16.183 ieautosearch

    >>
    >> >O4 - HKLM\..\Run: [Search-Exe] "C:\Program Files\se\v11\se.EXE" /H

    >>
    >> Have HijackThis fix the above entries.
    >>
    >>
    >> >O4 - Startup: SpywareGuard.lnk = C:\Program
    >> >Files\SpywareGuard\sgmain.exe

    >>
    >> **** As I have always maintained, SpywareGuard is
    >> crap, and it is NOT protecting your system.
    >>
    >>
    >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll
    >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll
    >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll
    >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll

    >>
    >> Have HijackThis fix the above, and then (IMPORTANT),
    >> run LSP-Fix.
    >>
    >>
    >> Open your registry editor (Start / Run / Regedit) to:
    >> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    >> If you see an entry named '__NS_Service_3' delete it.
    >>
    >> Still in the registry, navigate to:
    >> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root
    >> If you see an entry named 'LEGACY___NS_Service_3' delete it.
    >>
    >> Close your registry editor.
    >>
    >> Do NOT reconnect; do NOT reboot into normal mode, yet.
    >>
    >> Run SpyBot S&D (full scan)
    >>
    >> Run Ad-Aware (full scan)
    >>
    >> Run the Ad-Aware VX2 cleaner plug-in.
    >>
    >> Run the SpHjfix.
    >>
    >> Run CWShredder
    >>
    >> Run AboutBuster
    >>
    >> Re-run HijackThis and rescan.
    >>
    >>
    >> If SpyBot S&D and/or Ad-Aware do not run in Safe
    >> Mode, leave those steps until last and run them
    >> in normal mode, BEFORE YOU CONNECT.
    >>
    >>
    >> --
    >> Basic computer maintenance
    >> http://uk.geocities.com/personel44/maintenance.html

    >


    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
    °Mike°, Jul 30, 2004
    #3
  4. jvco777

    °Mike° Guest

    On Fri, 30 Jul 2004 23:28:15 GMT, in
    <jQAOc.460$>
    JB scrawled:

    >What are you talking about ???


    You have the nerve to ask *me* what *I'm* talking
    about? ROTFLMAO! That's rich, that is.

    >anyone understand that post
    >MIKE: if he has ran adaware & spybot would'nt you update them
    >you just have to be better than everyone dont you


    So, now you're post editing, and trying to put words
    into my mouth, that were never uttered? You must
    be related to Plato.

    >"Jimmy, you really should stay off the pop. I do NOT need to
    >> "avoid doing all that", neither do I need to reinstall my operating
    >> system; neither does the OP, for that matter."

    >
    >that is directed at the origanal poster you fool dont you think he/she will
    >read it??


    Exactly my point, dolt! When you have something to say to
    the original poster, reply to THEM, not somebody else.


    >"°Mike°" <> wrote in message
    >news:...
    >> On Fri, 30 Jul 2004 22:54:37 GMT, in
    >> <NkAOc.583$>
    >> JB scrawled:
    >>
    >> >Mike you superseed yourself again, READ "I've ran adaware and spybot and
    >> >both have been updated" miss that did you,

    >>
    >> There was no mention of *when* they were updated. Now, is
    >> there anything else that you'd like to pick at?
    >>
    >> >If you want to avoid doing all that then back up your personal data and
    >> >reinstall your operating system, this procedure will take less time and

    >you
    >> >are guaranteed a clean machine, well at least until you download and

    >install
    >> >more freeware crap

    >>
    >> Jimmy, you really should stay off the pop. I do NOT need to
    >> "avoid doing all that", neither do I need to reinstall my operating
    >> system; neither does the OP, for that matter.
    >>
    >> If you're going to reply, at least reply to the correct person.
    >>
    >>
    >> >"°Mike°" <> wrote in message
    >> >news:...
    >> >> Before you proceed, make sure that you have
    >> >> SpyBot S&D and Ad-Aware updated.
    >> >>
    >> >> Be sure to download and install the Ad-Aware
    >> >> VX2 cleaner plug-in
    >> >> http://www.lavasoftusa.com/software/plugins/vx2cleaner.shtml
    >> >>
    >> >> Download LSP-Fix (IMPORTANT).
    >> >> http://cexx.org/lspfix.htm
    >> >>
    >> >> Download SpHjfix fix.
    >> >> http://www.trojaner-info.de/cgi-bin/download.cgi?file=sphjfix
    >> >>
    >> >> Download AboutBuster
    >> >> http://tools.zerosrealm.com/AboutBuster.zip
    >> >>
    >> >> Download CWShredder
    >> >> http://www.spywareinfo.com/~merijn/cwschronicles.html
    >> >>
    >> >>
    >> >> Boot into Safe Mode once that's done. As soon as you
    >> >> have booted into Safe Mode, empty your TEMP folder,
    >> >> your Temporary Internet Files (including Offline Content),
    >> >> and your IE History.
    >> >>
    >> >>
    >> >> Continued inline ....
    >> >>
    >> >>
    >> >> On 30 Jul 2004 10:54:28 -0700, in
    >> >> <>
    >> >> jvco777 scrawled:
    >> >>
    >> >> >Here is a log of hijack this. I'm having severe problems with my
    >> >> >browser wherein popups just keep coming out. I've ran adaware and
    >> >> >spybot and both have been updated. Also I have spyguard and
    >> >> >spywareblaster installed as well. However, i'm still experiencing
    >> >> >these problems and am getting really annoyed at these companies. If
    >> >> >anyone can take a look at my log and tell me whats wrong w/ my PC i
    >> >> >would really appreciate it. Also I notice that before that popup
    >> >> >comes out a window with title "c.azjmpr" comes out.
    >> >> >
    >> >> >Logfile of HijackThis v1.98.0
    >> >> >Scan saved at 10:44:47 AM, on 7/30/2004
    >> >> >Platform: Windows XP SP1 (WinNT 5.01.2600)
    >> >> >MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    >> >>
    >> >>
    >> >> DO THIS IN SAFE MODE
    >> >> =================
    >> >>
    >> >> DISCONNECT FROM THE NET
    >> >> =====================
    >> >>
    >> >> CLOSE ALL OTHER APPLICATIONS EXCEPT HJT
    >> >> ==================================
    >> >>
    >> >>
    >> >> >R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant

    >=
    >> >>

    >>
    >>>http://www.pxnggvdgylirdxbilrq.org/GpPJB8iGyUzvR0/1jve1KDq8//GYnAMLxVK83EF

    >O
    >> >n_pM9sbchte333/9MAStQbZm.htm
    >> >>
    >> >> >R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=
    >> >>
    >> >> >R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
    >> >>

    >>
    >>>http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
    >> >>
    >> >> >R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
    >> >>

    >>
    >>>http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
    >> >>
    >> >> >R3 - URLSearchHook: WebSearch Class -
    >> >> >{9368D063-44BE-49B9-BD14-BB9663FD38FC} - C:\Program
    >> >> >Files\se\v11\se.DLL (file missing)
    >> >>
    >> >> >O1 - Hosts: 69.20.16.183 ieautosearch
    >> >>
    >> >> >O4 - HKLM\..\Run: [Search-Exe] "C:\Program Files\se\v11\se.EXE" /H
    >> >>
    >> >> Have HijackThis fix the above entries.
    >> >>
    >> >>
    >> >> >O4 - Startup: SpywareGuard.lnk = C:\Program
    >> >> >Files\SpywareGuard\sgmain.exe
    >> >>
    >> >> **** As I have always maintained, SpywareGuard is
    >> >> crap, and it is NOT protecting your system.
    >> >>
    >> >>
    >> >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll
    >> >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll
    >> >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll
    >> >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    >> >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    >> >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    >> >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    >> >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll
    >> >>
    >> >> Have HijackThis fix the above, and then (IMPORTANT),
    >> >> run LSP-Fix.
    >> >>
    >> >>
    >> >> Open your registry editor (Start / Run / Regedit) to:
    >> >> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    >> >> If you see an entry named '__NS_Service_3' delete it.
    >> >>
    >> >> Still in the registry, navigate to:
    >> >> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root
    >> >> If you see an entry named 'LEGACY___NS_Service_3' delete it.
    >> >>
    >> >> Close your registry editor.
    >> >>
    >> >> Do NOT reconnect; do NOT reboot into normal mode, yet.
    >> >>
    >> >> Run SpyBot S&D (full scan)
    >> >>
    >> >> Run Ad-Aware (full scan)
    >> >>
    >> >> Run the Ad-Aware VX2 cleaner plug-in.
    >> >>
    >> >> Run the SpHjfix.
    >> >>
    >> >> Run CWShredder
    >> >>
    >> >> Run AboutBuster
    >> >>
    >> >> Re-run HijackThis and rescan.
    >> >>
    >> >>
    >> >> If SpyBot S&D and/or Ad-Aware do not run in Safe
    >> >> Mode, leave those steps until last and run them
    >> >> in normal mode, BEFORE YOU CONNECT.
    >> >>
    >> >>
    >> >> --
    >> >> Basic computer maintenance
    >> >> http://uk.geocities.com/personel44/maintenance.html
    >> >

    >>
    >> --
    >> Basic computer maintenance
    >> http://uk.geocities.com/personel44/maintenance.html

    >


    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
    °Mike°, Jul 30, 2004
    #4
  5. jvco777

    JB Guest

    Mike you superseed yourself again, READ "I've ran adaware and spybot and
    both have been updated" miss that did you,


    If you want to avoid doing all that then back up your personal data and
    reinstall your operating system, this procedure will take less time and you
    are guaranteed a clean machine, well at least until you download and install
    more freeware crap




    "°Mike°" <> wrote in message
    news:...
    > Before you proceed, make sure that you have
    > SpyBot S&D and Ad-Aware updated.
    >
    > Be sure to download and install the Ad-Aware
    > VX2 cleaner plug-in
    > http://www.lavasoftusa.com/software/plugins/vx2cleaner.shtml
    >
    > Download LSP-Fix (IMPORTANT).
    > http://cexx.org/lspfix.htm
    >
    > Download SpHjfix fix.
    > http://www.trojaner-info.de/cgi-bin/download.cgi?file=sphjfix
    >
    > Download AboutBuster
    > http://tools.zerosrealm.com/AboutBuster.zip
    >
    > Download CWShredder
    > http://www.spywareinfo.com/~merijn/cwschronicles.html
    >
    >
    > Boot into Safe Mode once that's done. As soon as you
    > have booted into Safe Mode, empty your TEMP folder,
    > your Temporary Internet Files (including Offline Content),
    > and your IE History.
    >
    >
    > Continued inline ....
    >
    >
    > On 30 Jul 2004 10:54:28 -0700, in
    > <>
    > jvco777 scrawled:
    >
    > >Here is a log of hijack this. I'm having severe problems with my
    > >browser wherein popups just keep coming out. I've ran adaware and
    > >spybot and both have been updated. Also I have spyguard and
    > >spywareblaster installed as well. However, i'm still experiencing
    > >these problems and am getting really annoyed at these companies. If
    > >anyone can take a look at my log and tell me whats wrong w/ my PC i
    > >would really appreciate it. Also I notice that before that popup
    > >comes out a window with title "c.azjmpr" comes out.
    > >
    > >Logfile of HijackThis v1.98.0
    > >Scan saved at 10:44:47 AM, on 7/30/2004
    > >Platform: Windows XP SP1 (WinNT 5.01.2600)
    > >MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    >
    >
    > DO THIS IN SAFE MODE
    > =================
    >
    > DISCONNECT FROM THE NET
    > =====================
    >
    > CLOSE ALL OTHER APPLICATIONS EXCEPT HJT
    > ==================================
    >
    >
    > >R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

    >
    >http://www.pxnggvdgylirdxbilrq.org/GpPJB8iGyUzvR0/1jve1KDq8//GYnAMLxVK83EFO

    n_pM9sbchte333/9MAStQbZm.htm
    >
    > >R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=

    >
    > >R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =

    >
    >http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
    >
    > >R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) =

    >
    >http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
    >
    > >R3 - URLSearchHook: WebSearch Class -
    > >{9368D063-44BE-49B9-BD14-BB9663FD38FC} - C:\Program
    > >Files\se\v11\se.DLL (file missing)

    >
    > >O1 - Hosts: 69.20.16.183 ieautosearch

    >
    > >O4 - HKLM\..\Run: [Search-Exe] "C:\Program Files\se\v11\se.EXE" /H

    >
    > Have HijackThis fix the above entries.
    >
    >
    > >O4 - Startup: SpywareGuard.lnk = C:\Program
    > >Files\SpywareGuard\sgmain.exe

    >
    > **** As I have always maintained, SpywareGuard is
    > crap, and it is NOT protecting your system.
    >
    >
    > >O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll
    > >O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll
    > >O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll
    > >O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    > >O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    > >O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    > >O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    > >O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll

    >
    > Have HijackThis fix the above, and then (IMPORTANT),
    > run LSP-Fix.
    >
    >
    > Open your registry editor (Start / Run / Regedit) to:
    > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    > If you see an entry named '__NS_Service_3' delete it.
    >
    > Still in the registry, navigate to:
    > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root
    > If you see an entry named 'LEGACY___NS_Service_3' delete it.
    >
    > Close your registry editor.
    >
    > Do NOT reconnect; do NOT reboot into normal mode, yet.
    >
    > Run SpyBot S&D (full scan)
    >
    > Run Ad-Aware (full scan)
    >
    > Run the Ad-Aware VX2 cleaner plug-in.
    >
    > Run the SpHjfix.
    >
    > Run CWShredder
    >
    > Run AboutBuster
    >
    > Re-run HijackThis and rescan.
    >
    >
    > If SpyBot S&D and/or Ad-Aware do not run in Safe
    > Mode, leave those steps until last and run them
    > in normal mode, BEFORE YOU CONNECT.
    >
    >
    > --
    > Basic computer maintenance
    > http://uk.geocities.com/personel44/maintenance.html
    JB, Jul 30, 2004
    #5
  6. jvco777

    JB Guest

    What are you talking about ???
    anyone understand that post
    MIKE: if he has ran adaware & spybot would'nt you update them
    you just have to be better than everyone dont you

    "Jimmy, you really should stay off the pop. I do NOT need to
    > "avoid doing all that", neither do I need to reinstall my operating
    > system; neither does the OP, for that matter."


    that is directed at the origanal poster you fool dont you think he/she will
    read it??




    "°Mike°" <> wrote in message
    news:...
    > On Fri, 30 Jul 2004 22:54:37 GMT, in
    > <NkAOc.583$>
    > JB scrawled:
    >
    > >Mike you superseed yourself again, READ "I've ran adaware and spybot and
    > >both have been updated" miss that did you,

    >
    > There was no mention of *when* they were updated. Now, is
    > there anything else that you'd like to pick at?
    >
    > >If you want to avoid doing all that then back up your personal data and
    > >reinstall your operating system, this procedure will take less time and

    you
    > >are guaranteed a clean machine, well at least until you download and

    install
    > >more freeware crap

    >
    > Jimmy, you really should stay off the pop. I do NOT need to
    > "avoid doing all that", neither do I need to reinstall my operating
    > system; neither does the OP, for that matter.
    >
    > If you're going to reply, at least reply to the correct person.
    >
    >
    > >"°Mike°" <> wrote in message
    > >news:...
    > >> Before you proceed, make sure that you have
    > >> SpyBot S&D and Ad-Aware updated.
    > >>
    > >> Be sure to download and install the Ad-Aware
    > >> VX2 cleaner plug-in
    > >> http://www.lavasoftusa.com/software/plugins/vx2cleaner.shtml
    > >>
    > >> Download LSP-Fix (IMPORTANT).
    > >> http://cexx.org/lspfix.htm
    > >>
    > >> Download SpHjfix fix.
    > >> http://www.trojaner-info.de/cgi-bin/download.cgi?file=sphjfix
    > >>
    > >> Download AboutBuster
    > >> http://tools.zerosrealm.com/AboutBuster.zip
    > >>
    > >> Download CWShredder
    > >> http://www.spywareinfo.com/~merijn/cwschronicles.html
    > >>
    > >>
    > >> Boot into Safe Mode once that's done. As soon as you
    > >> have booted into Safe Mode, empty your TEMP folder,
    > >> your Temporary Internet Files (including Offline Content),
    > >> and your IE History.
    > >>
    > >>
    > >> Continued inline ....
    > >>
    > >>
    > >> On 30 Jul 2004 10:54:28 -0700, in
    > >> <>
    > >> jvco777 scrawled:
    > >>
    > >> >Here is a log of hijack this. I'm having severe problems with my
    > >> >browser wherein popups just keep coming out. I've ran adaware and
    > >> >spybot and both have been updated. Also I have spyguard and
    > >> >spywareblaster installed as well. However, i'm still experiencing
    > >> >these problems and am getting really annoyed at these companies. If
    > >> >anyone can take a look at my log and tell me whats wrong w/ my PC i
    > >> >would really appreciate it. Also I notice that before that popup
    > >> >comes out a window with title "c.azjmpr" comes out.
    > >> >
    > >> >Logfile of HijackThis v1.98.0
    > >> >Scan saved at 10:44:47 AM, on 7/30/2004
    > >> >Platform: Windows XP SP1 (WinNT 5.01.2600)
    > >> >MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    > >>
    > >>
    > >> DO THIS IN SAFE MODE
    > >> =================
    > >>
    > >> DISCONNECT FROM THE NET
    > >> =====================
    > >>
    > >> CLOSE ALL OTHER APPLICATIONS EXCEPT HJT
    > >> ==================================
    > >>
    > >>
    > >> >R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant

    =
    > >>

    >
    >>http://www.pxnggvdgylirdxbilrq.org/GpPJB8iGyUzvR0/1jve1KDq8//GYnAMLxVK83EF

    O
    > >n_pM9sbchte333/9MAStQbZm.htm
    > >>
    > >> >R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=
    > >>
    > >> >R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
    > >>

    >
    >>http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
    > >>
    > >> >R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
    > >>

    >
    >>http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
    > >>
    > >> >R3 - URLSearchHook: WebSearch Class -
    > >> >{9368D063-44BE-49B9-BD14-BB9663FD38FC} - C:\Program
    > >> >Files\se\v11\se.DLL (file missing)
    > >>
    > >> >O1 - Hosts: 69.20.16.183 ieautosearch
    > >>
    > >> >O4 - HKLM\..\Run: [Search-Exe] "C:\Program Files\se\v11\se.EXE" /H
    > >>
    > >> Have HijackThis fix the above entries.
    > >>
    > >>
    > >> >O4 - Startup: SpywareGuard.lnk = C:\Program
    > >> >Files\SpywareGuard\sgmain.exe
    > >>
    > >> **** As I have always maintained, SpywareGuard is
    > >> crap, and it is NOT protecting your system.
    > >>
    > >>
    > >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll
    > >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll
    > >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll
    > >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    > >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    > >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    > >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\lspak.dll
    > >> >O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdlsp.dll
    > >>
    > >> Have HijackThis fix the above, and then (IMPORTANT),
    > >> run LSP-Fix.
    > >>
    > >>
    > >> Open your registry editor (Start / Run / Regedit) to:
    > >> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    > >> If you see an entry named '__NS_Service_3' delete it.
    > >>
    > >> Still in the registry, navigate to:
    > >> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root
    > >> If you see an entry named 'LEGACY___NS_Service_3' delete it.
    > >>
    > >> Close your registry editor.
    > >>
    > >> Do NOT reconnect; do NOT reboot into normal mode, yet.
    > >>
    > >> Run SpyBot S&D (full scan)
    > >>
    > >> Run Ad-Aware (full scan)
    > >>
    > >> Run the Ad-Aware VX2 cleaner plug-in.
    > >>
    > >> Run the SpHjfix.
    > >>
    > >> Run CWShredder
    > >>
    > >> Run AboutBuster
    > >>
    > >> Re-run HijackThis and rescan.
    > >>
    > >>
    > >> If SpyBot S&D and/or Ad-Aware do not run in Safe
    > >> Mode, leave those steps until last and run them
    > >> in normal mode, BEFORE YOU CONNECT.
    > >>
    > >>
    > >> --
    > >> Basic computer maintenance
    > >> http://uk.geocities.com/personel44/maintenance.html

    > >

    >
    > --
    > Basic computer maintenance
    > http://uk.geocities.com/personel44/maintenance.html
    JB, Jul 31, 2004
    #6
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Beverly Howard [Ms-MVP/MobileDev]

    "Home, etc" popup on AP discovery

    Beverly Howard [Ms-MVP/MobileDev], Jan 31, 2005, in forum: Wireless Networking
    Replies:
    2
    Views:
    540
    Beverly Howard [Ms-MVP/MobileDev]
    Feb 2, 2005
  2. =?Utf-8?B?Q3lu?=

    How to get rid of popup asking for user ID and password

    =?Utf-8?B?Q3lu?=, Feb 7, 2005, in forum: Wireless Networking
    Replies:
    1
    Views:
    581
    Carey Holzman
    Feb 8, 2005
  3. Axl
    Replies:
    0
    Views:
    399
  4. Axl
    Replies:
    3
    Views:
    1,910
    dantu
    Dec 10, 2003
  5. sharonf

    Problems with Popup blocker in IE in Hotmail

    sharonf, Dec 27, 2006, in forum: Computer Support
    Replies:
    1
    Views:
    442
    pcbutts1
    Dec 27, 2006
Loading...

Share This Page